The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.

This update fixes two vulnerabilities that affect the backend server and can only be exploited by authenticated users to cause a denial-of-service, or maybe to access other tables/databases without authentication. (CVE-2007-0555 CVE-2007-0556)

This update fixes two vulnerabilities that affect the backend server and can only be exploited by authenticated users to cause a denial-of-service, or maybe to access other tables/databases without authentication. (CVE-2007-0555 / CVE-2007-0556)

USN-417-1 fixed several vulnerabilities in the PostgreSQL server.
Unfortunately this update had a regression that caused some valid queries to be aborted with a type error. This update corrects that problem.

We apologize for the inconvenience.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Jeff Trout discovered that the PostgreSQL server did not sufficiently check data types of SQL function arguments in some cases. An authenticated attacker could exploit this to crash the database server or read out arbitrary locations in the server's memory, which could allow retrieving database content the attacker should not be able to see. (CVE-2007-0555)

Jeff Trout reported that the query planner did not verify that a table was still compatible with a previously made query plan. By using ALTER COLUMN TYPE during query execution, an attacker could exploit this to read out arbitrary locations in the server's memory, which could allow retrieving database content the attacker should not be able to see.
(CVE-2007-0556).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update fixes two vulnerabilities that affect the backend server and can only be exploited by authenticated users to cause a denial-of-service, or maybe to access other tables/databases without authentication. (CVE-2007-0555, CVE-2007-0556)

Updated postgresql packages that fix several security issues are now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced Object-Relational database management system (DBMS).

Two flaws were found in the way the PostgreSQL server handles certain SQL-language functions. An authenticated user could execute a sequence of commands which could crash the PostgreSQL server or possibly read from arbitrary memory locations. A user would need to have permissions to drop and add database tables to be able to exploit these issues (CVE-2007-0555, CVE-2007-0556).

Several denial of service flaws were found in the PostgreSQL server.
An authenticated user could execute certain SQL commands which could crash the PostgreSQL server (CVE-2006-5540, CVE-2006-5541, CVE-2006-5542).

Users of PostgreSQL should upgrade to these updated packages containing PostgreSQL version 8.1.8 which corrects these issues.

The remote host is affected by the vulnerability described in GLSA-200703-15 (PostgreSQL: Multiple vulnerabilities)

    PostgreSQL does not correctly check the data types of the SQL function     arguments under unspecified circumstances nor the format of the     provided tables in the query planner.
  Impact :

    A remote authenticated attacker could send specially crafted queries to     the server that could result in a server crash and possibly the     unauthorized reading of some database content or arbitrary memory.
  Workaround :

    There is no known workaround at this time.

Jeff Trout discovered that the PostgreSQL server did not sufficiently check data types of SQL function arguments in some cases. A user could then exploit this to crash the database server or read out arbitrary locations of the server's memory, which could be used to retrieve database contents that the user should not be able to see. Note that a user must be authenticated in order to exploit this (CVE-2007-0555).

As well, Jeff Trout also discovered that the query planner did not verify that a table was still compatible with a previously-generated query plan, which could be exploited to read out arbitrary locations of the server's memory by using ALTER COLUMN TYPE during query execution. Again, a user must be authenticated in order to exploit this (CVE-2007-0556).

Update :

The previous update updated PostgreSQL to upstream versions, including 8.1.7 which contained a bug with typemod data types used with check constraints and expression indexes. This regression has been corrected in the new 8.1.8 version that is being provided.

- Sun Feb 4 2007 Tom Lane <tgl at redhat.com> 8.1.7-1

    - Update to PostgreSQL 8.1.7 to fix CVE-2007-0555,       CVE-2007-0556 Related: #225496

  - Wed Jan 10 2007 Tom Lane <tgl at redhat.com> 8.1.6-1

    - Update to PostgreSQL 8.1.6

    - Mon Dec 11 2006 Tom Lane <tgl at redhat.com> 8.1.5-1

    - Update to PostgreSQL 8.1.5

    - Update to PyGreSQL 3.8.1

    - Adjust init script to not fool /etc/rc.d/rc Resolves:
      #161470

  - Fix chcon arguments in test/regress/Makefile Resolves:
    #201035

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running PostgreSQL, an open source relational database.  This version is vulnerable to multiple flaws where an attacker with a valid user account can cause the service to stop or potentially disclose confidential information.  Successful exploitation would result in the system being unavailable to legitimate users or the leakage of confidential data. 

ID	Name	Product	Family	Severity
41132	SuSE9 Security Update : PostgreSQL (YOU Patch Number 11509)	Nessus	SuSE Local Security Checks	high
29558	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 3244)	Nessus	SuSE Local Security Checks	high
28008	Ubuntu 6.06 LTS / 6.10 : postgresql-8.1 regression (USN-417-2)	Nessus	Ubuntu Local Security Checks	high
28007	Ubuntu 5.10 / 6.06 LTS / 6.10 : postgresql-7.4/-8.0/-8.1 vulnerabilities (USN-417-1)	Nessus	Ubuntu Local Security Checks	high
27401	openSUSE 10 Security Update : postgresql (postgresql-3243)	Nessus	SuSE Local Security Checks	high
25315	RHEL 5 : postgresql (RHSA-2007:0068)	Nessus	Red Hat Local Security Checks	high
24840	GLSA-200703-15 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
24650	Mandrake Linux Security Advisory : postgresql (MDKSA-2007:037-1)	Nessus	Mandriva Local Security Checks	high
24302	Fedora Core 5 : postgresql-8.1.7-1.fc5 (2007-198)	Nessus	Fedora Local Security Checks	high
3901	PostgreSQL Multiple Vulnerabilities	Nessus Network Monitor	Database	medium

Detections

Analytics

CVE-2007-0556

medium

Tenable Plugins

high

high

high

high

high

high

high

high

high

medium