Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

PostgreSQL 9.2.x < 9.2.20 / 9.3.x < 9.3.16 / 9.4.x < 9.4.11 / 9.5.x < 9.5.6 / 9.6.x < 9.6.2 Multiple Vulnerabilities

High

Synopsis

The database running on the remote server is affected by multiple attack vectors.

Description

The version of PostgreSQL installed on the remote host is 9.2.x prior to 9.2.20, 9.3.x prior to 9.3.16, 9.4.x prior to 9.4.11, 9.5.x prior to 9.5.6 or 9.6.x prior to 9.6.2 and is affected by a the following vulnerabilities :

- An off-by-one overflow condition exists in the 'quote_literal_cstr()' function. The issue is triggered as certain input is not properly validated when encased entirely in single quotes or backslashes. This may allow a remote attacker to cause a buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (OSVDB 152268) - A flaw exists that is triggered during the handling of multiple concurrent calls of 'pg_strat_backup()' and 'pg_stop_backup()'. This may allow a remote attacker to cause a denial of service. (OSVDB 152269) - An off-by-one overflow condition exists that is triggered as certain input is not properly validated when handling a filename supplied to 'ecpg' that ends with a dot. This may allow a remote attacker to cause a limited buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code. (OSVDB 152270)

Solution

Upgrade to PostgreSQL 9.6.2 or later. If 9.6.x cannot be obtained, 9.5.6, 9.4.11, 9.3.16, and 9.2.20 have also been patched for these vulnerabilities.