The make_oidjoins_check script in PostgreSQL 7.4.5 and earlier allows local users to overwrite files via a symlink attack on temporary files.

The make_oidjoins_check script in the PostgreSQL RDBMS has insecure handling of temporary files, which could lead to an attacker overwriting arbitrary files with the credentials of the user running the make_oidjoins_check script.

Recently, Trustix Secure Linux discovered a vulnerability in the postgresql-contrib package. The script 'make_oidjoins_check' created temporary files in an insecure way, which allowed a symlink attack to create or overwrite arbitrary files with the privileges of the user invoking the script.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Updated rh-postgresql packages that fix various bugs are now available.

PostgreSQL is an advanced Object-Relational database management system (DBMS) that supports almost all SQL constructs (including transactions, subselects, and user-defined types and functions).

Trustix has identified improper temporary file usage in the make_oidjoins_check script. It is possible that an attacker could overwrite arbitrary file contents as the user running the make_oidjoins_check script. This script has been removed from the RPM file since it has no use to ordinary users. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2004-0977 to this issue.

Additionally, the following non-security issues have been addressed :

  - Fixed a low probability risk for loss of recently     committed transactions.

  - Fixed a low probability risk for loss of older data due     to failure to update transaction status.

  - A lock file problem that sometimes prevented automatic     restart after a system crash has been fixed.

All users of rh-postgresql should upgrade to these updated packages, which resolve these issues.

The Trustix development team found insecure temporary file creation problems in a script included in the postgresql package. This could allow an attacker to trick a user into overwriting arbitrary files he has access to.

The updated packages have been patched to prevent this problem.

Trustix Security Engineers identified insecure temporary file creation in a script included in the postgresql suite, an object-relational SQL database. This could lead an attacker to trick a user to overwrite arbitrary files he has write access to.

The remote host is affected by the vulnerability described in GLSA-200410-16 (PostgreSQL: Insecure temporary file use in make_oidjoins_check)

    The make_oidjoins_check script insecurely creates temporary files in     world-writeable directories with predictable names.
  Impact :

    A local attacker could create symbolic links in the temporary files     directory, pointing to a valid file somewhere on the filesystem. When     make_oidjoins_check is called, this would result in file overwrite with     the rights of the user running the utility, which could be the root     user.
  Workaround :

    There is no known workaround at this time.

The remote PostgreSQL server, according to its version number, is vulnerable to an unspecified insecure temporary file creation flaw, which may allow a local attacker to overwrite arbitrary files with the privileges of the application.

ID	Name	Product	Family	Severity
37716	FreeBSD : postgresql-contrib -- insecure temporary file creation (6a164d84-2f7f-11d9-a9e7-0001020eed82)	Nessus	FreeBSD Local Security Checks	low
20678	Ubuntu 4.10 : postgresql contributed script vulnerability (USN-6-1)	Nessus	Ubuntu Local Security Checks	low
16016	RHEL 3 : rh-postgresql (RHSA-2004:489)	Nessus	Red Hat Local Security Checks	low
15957	Mandrake Linux Security Advisory : postgresql (MDKSA-2004:149)	Nessus	Mandriva Local Security Checks	low
15675	Debian DSA-577-1 : postgresql - insecure temporary file	Nessus	Debian Local Security Checks	low
15513	GLSA-200410-16 : PostgreSQL: Insecure temporary file use in make_oidjoins_check	Nessus	Gentoo Local Security Checks	low
15417	PostgreSQL make_oidjoins_check Arbitrary File Overwrite	Nessus	Databases	low

Detections

Analytics

CVE-2004-0977

medium

Tenable Plugins

low

low

low

low

low

low

low