CVE-2007-6600

Description

PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.

References

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00469.html

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00397.html

https://usn.ubuntu.com/568-1/

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10493

https://issues.rpath.com/browse/RPL-1768

https://exchange.xforce.ibmcloud.com/vulnerabilities/39496

http://www.vupen.com/english/advisories/2008/1071/references

http://www.vupen.com/english/advisories/2008/0109

http://www.vupen.com/english/advisories/2008/0061

http://www.securityfocus.com/bid/27163

http://www.securityfocus.com/archive/1/486407/100/0/threaded

http://www.securityfocus.com/archive/1/485864/100/0/threaded

http://www.redhat.com/support/errata/RHSA-2008-0040.html

http://www.redhat.com/support/errata/RHSA-2008-0039.html

http://www.redhat.com/support/errata/RHSA-2008-0038.html

http://www.postgresql.org/about/news.905

http://www.mandriva.com/security/advisories?name=MDVSA-2008:004

http://www.debian.org/security/2008/dsa-1463

http://www.debian.org/security/2008/dsa-1460

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1

http://securitytracker.com/id?1019157

http://security.gentoo.org/glsa/glsa-200801-15.xml

http://secunia.com/advisories/29638

http://secunia.com/advisories/28698

http://secunia.com/advisories/28679

http://secunia.com/advisories/28479

http://secunia.com/advisories/28477

http://secunia.com/advisories/28464

http://secunia.com/advisories/28455

http://secunia.com/advisories/28454

http://secunia.com/advisories/28445

http://secunia.com/advisories/28438

http://secunia.com/advisories/28437

http://secunia.com/advisories/28376

http://secunia.com/advisories/28359

http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3