Buffer overflow in to_ascii for PostgreSQL 7.2.x, and 7.3.x before 7.3.4, allows remote attackers to execute arbitrary code.

Tom Lane discovered a buffer overflow in the to_ascii function in PostgreSQL. This allows remote attackers to execute arbitrary code on the host running the database.

Two bugs were discovered that lead to a buffer overflow in PostgreSQL versions 7.2.x and 7.3.x prior to 7.3.4, in the abstract data type (ADT) to ASCII conversion functions. It is believed that, under the right circumstances, an attacker may use this vulnerability to execute arbitrary instructions on the PostgreSQL server.

The provided packages are patched to protect against this vulnerability and all users are encouraged to upgrade immediately.

Updated PostgreSQL packages that correct a buffer overflow in the to_ascii routines are now available.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

Two bugs that can lead to buffer overflows have been found in the PostgreSQL abstract data type to ASCII conversion routines. A remote attacker who is able to influence the data passed to the to_ascii functions may be able to execute arbitrary code in the context of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2003-0901 to these issues.

In addition, a bug that can lead to leaks has been found in the string to timestamp abstract data type conversion routine. If the input string to the to_timestamp() routine is shorter than what the template string is expecting, the routine will run off the end of the input string, resulting in a leak and unstable behaviour.

Users of PostgreSQL are advised to upgrade to these erratum packages, which contain a backported patch that corrects these issues.

According to its version number, the PostgreSQL server listening on this port is vulnerable to two buffer overflows in the to_ascii() function that could allow an attacker who can query the remote database to execute arbitrary code, subject to the privileges under which the service operates.

ID	Name	Product	Family	Severity
15234	Debian DSA-397-1 : postgresql - buffer overflow	Nessus	Debian Local Security Checks	high
14084	Mandrake Linux Security Advisory : postgresql (MDKSA-2003:102)	Nessus	Mandriva Local Security Checks	high
12430	RHEL 2.1 : postgresql (RHSA-2003:314)	Nessus	Red Hat Local Security Checks	high
11916	PostgreSQL to_ascii() Function Remote Overflows	Nessus	Databases	high

Detections

Analytics

CVE-2003-0901

critical

Tenable Plugins

high

high

high

high