CVE-2007-3278

Description

PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.

References

https://usn.ubuntu.com/568-1/

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10334

https://exchange.xforce.ibmcloud.com/vulnerabilities/35142

http://www.vupen.com/english/advisories/2008/1071/references

http://www.vupen.com/english/advisories/2008/0109

http://www.securityfocus.com/archive/1/471644/100/0/threaded

http://www.securityfocus.com/archive/1/471541/100/0/threaded

http://www.redhat.com/support/errata/RHSA-2008-0040.html

http://www.redhat.com/support/errata/RHSA-2008-0039.html

http://www.redhat.com/support/errata/RHSA-2008-0038.html

http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf

http://www.mandriva.com/security/advisories?name=MDKSA-2007:188

http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt

http://www.debian.org/security/2008/dsa-1463

http://www.debian.org/security/2008/dsa-1460

http://security.gentoo.org/glsa/glsa-200801-15.xml

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3