PostgreSQL 8.0.0 and earlier allows local users to bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command.

Multiple vulnerabilities had been reported in various versions of PostgreSQL :

- The EXECUTE restrictions can be bypassed by using the AGGREGATE function, which is missing a permissions check.

- A buffer overflow exists in gram.y which could allow an attacker to execute arbitrary code by sending a large number of arguments to a refcursor function, found in gram.y

- The intagg contributed module allows an attacker to crash the server (Denial of Service) by constructing a malicious crafted array.

The remote host is running PHP iCalendar, an open-source PHP blog.  This version of iCalendar is vulnerable to a flaw wherein a local user can gain access to confidential data by requesting the data from the iCalendar application.  Successful exploitation would lead to a local user gaining access to confidential data.  In addition, the remote host is vulnerable to a remote file upload flaw.  An attacker exploiting this flaw would be able to manipulate the application into uploading and executing potentially malicious scripts.  

The execution of custom PostgreSQL functions can be restricted with the EXECUTE privilege. However, previous versions did not check this privilege when executing a function which was part of an aggregate. As a result, any database user could circumvent the EXECUTE restriction of functions with a particular (but very common) parameter structure by creating an aggregate wrapper around the function. (CAN-2005-0244)

Several buffer overflows have been discovered in the SQL parser. These could be exploited by any database user to crash the PostgreSQL server or execute arbitrary code with the privileges of the server.
(CAN-2005-0245, CAN-2005-0247)

Finally, this update fixes a Denial of Service vulnerability of the contributed 'intagg' module. By constructing specially crafted arrays, a database user was able to corrupt and crash the PostgreSQL server.
(CAN-2005-0246). Please note that this module is part of the 'postgresql-contrib' package, which is not officially supported by Ubuntu.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 4 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2005:138 advisory.

    A flaw in the LOAD command in PostgreSQL was discovered. A local user     could use this flaw to load arbitrary shared libraries and therefore     execute arbitrary code, gaining the privileges of the PostgreSQL server.
    The Common Vulnerabilities and Exposures project (cve.mitre.org) has     assigned the name CAN-2005-0227 to this issue.

    A permission checking flaw in PostgreSQL was discovered. A local user     could bypass the EXECUTE permission check for functions by using the CREATE     AGGREGATE command. The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0244 to this issue.

    Multiple buffer overflows were found in PL/PgSQL. A database user who has     permissions to create plpgsql functions could trigger this flaw which could     lead to arbitrary code execution, gaining the privileges of the PostgreSQL     server. The Common Vulnerabilities and Exposures project (cve.mitre.org)     has assigned the names CAN-2005-0245 and CAN-2005-0247 to these issues.

    A flaw in the integer aggregator (intagg) contrib module for PostgreSQL was     found. A user could create carefully crafted arrays and cause a denial of     service (crash). The Common Vulnerabilities and Exposures project     (cve.mitre.org) has assigned the name CAN-2005-0246 to this issue.

    The update also fixes some minor problems, notably conflicts with SELinux.

    Users of postgresql should update to these erratum packages that contain     patches and are not vulnerable to these issues.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A number of vulnerabilities were found and corrected in the PostgreSQL DBMS :

A flaw in the LOAD command could be abused by a local user to load arbitrary shared libraries and as a result execute arbitrary code with the privileges of the user running the postgresql server (CVE-2005-0227).

A permission checking flaw was found where a local user could bypass the EXECUTE permission check for functions using the CREATE AGGREGATE command (CVE-2005-0244).

Multiple buffer overflows were discovered in PL/PgSQL. A database user with permission to create plpgsql functions could trigger these flaws which could then lead to arbitrary code execution with the privileges of the user running the postgresql server (CVE-2005-0245 and CVE-2005-0247).

Finally, a flaw in the integer aggregator (intagg) contrib module was found. A user could create carefully crafted arrays and crash the server, causing a Denial of Service (CVE-2005-0246).

The updated packages have been patched to correct these problems.

The remote host is affected by the vulnerability described in GLSA-200502-08 (PostgreSQL: Multiple vulnerabilities)

    PostgreSQL's contains several vulnerabilities:
    John Heasman discovered that the LOAD extension is vulnerable to     local privilege escalation (CAN-2005-0227).
    It is possible to bypass the EXECUTE permission check for functions     (CAN-2005-0244).
    The PL/PgSQL parser is vulnerable to heap-based buffer overflow     (CAN-2005-0244).
    The intagg contrib module is vulnerable to a Denial of Service     (CAN-2005-0246).
  Impact :

    An attacker could exploit this to execute arbitrary code with the     privileges of the PostgreSQL server, bypass security restrictions and     crash the server.
  Workaround :

    There is no know workaround at this time.

Updated PostgreSQL packages to fix various security flaws are now available for Red Hat Enterprise Linux 3.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

A flaw in the LOAD command in PostgreSQL was discovered. A local user could use this flaw to load arbitrary shared librarys and therefore execute arbitrary code, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0227 to this issue.

A permission checking flaw in PostgreSQL was discovered. A local user could bypass the EXECUTE permission check for functions by using the CREATE AGGREGATE command. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0244 to this issue.

Multiple buffer overflows were found in PL/PgSQL. A database user who has permissions to create plpgsql functions could trigger this flaw which could lead to arbitrary code execution, gaining the privileges of the PostgreSQL server. The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the names CVE-2005-0245 and CVE-2005-0247 to these issues.

A flaw in the integer aggregator (intagg) contrib module for PostgreSQL was found. A user could create carefully crafted arrays and cause a denial of service (crash). The Common Vulnerabilities and Exposures project (cve.mitre.org) has assigned the name CVE-2005-0246 to this issue.

Users of PostgreSQL are advised to update to these erratum packages which are not vulnerable to these issues.

The remote PostgreSQL server, according to its version number, is vulnerable to multiple flaws that could allow an attacker who has the rights to query the remote database to obtain a shell on this host.

The remote PostgreSQL server is vulnerable to a number of critical flaws.  Some of these flaws require an attacker to have a valid account with credentials; however, some of the attacks do not require the attacker to have any sort of credentials.

ID	Name	Product	Family	Severity
22210	FreeBSD : postgresql -- multiple vulnerabilities (65c8ecf9-2adb-11db-a6e2-000e0c2e438a)	Nessus	FreeBSD Local Security Checks	high
3479	PHP iCalendar Local File Inclusion	Nessus Network Monitor	CGI	high
20702	Ubuntu 4.10 : postgresql vulnerabilities (USN-79-1)	Nessus	Ubuntu Local Security Checks	high
17192	RHEL 4 : postgresql (RHSA-2005:138)	Nessus	Red Hat Local Security Checks	critical
17139	Mandrake Linux Security Advisory : postgresql (MDKSA-2005:040)	Nessus	Mandriva Local Security Checks	high
16445	GLSA-200502-08 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
16386	RHEL 3 : rh-postgresql (RHSA-2005:141)	Nessus	Red Hat Local Security Checks	high
16309	PostgreSQL < 7.2.7 / 7.3.9 / 7.4.7 / 8.0.1 Multiple Vulnerabilities	Nessus	Databases	medium
2583	PostgreSQL < 8.0.1 Multiple Remote Vulnerabilities	Nessus Network Monitor	Database	medium

Detections

Analytics

CVE-2005-0244

high

Tenable Plugins

high

high

high

critical

high

high

high

medium

medium