Heap-based buffer overflow in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module 1.49 for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows.

The remote Oracle Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the ELSA-2009-0479 advisory.

    - fix CVE-2009-0663 and CVE-2009-1341

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

A heap-based buffer overflow flaw was discovered in the pg_getline function implementation. If the pg_getline or getline functions read large, untrusted records from a database, it could cause an application using these functions to crash or, possibly, execute arbitrary code. (CVE-2009-0663)

Note: After installing this update, pg_getline may return more data than specified by its second argument, as this argument will be ignored. This is consistent with current upstream behavior.
Previously, the length limit (the second argument) was not enforced, allowing a buffer overflow.

A memory leak flaw was found in the function performing the de-quoting of BYTEA type values acquired from a database. An attacker able to cause an application using perl-DBD-Pg to perform a large number of SQL queries returning BYTEA records, could cause the application to use excessive amounts of memory or, possibly, crash. (CVE-2009-1341)

Applications using perl-DBD-Pg must be restarted for the update to take effect.

An updated perl-DBD-Pg package that fixes two security issues is now available for Red Hat Enterprise Linux 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

Perl DBI is a database access Application Programming Interface (API) for the Perl language. perl-DBD-Pg allows Perl applications to access PostgreSQL database servers.

A heap-based buffer overflow flaw was discovered in the pg_getline function implementation. If the pg_getline or getline functions read large, untrusted records from a database, it could cause an application using these functions to crash or, possibly, execute arbitrary code. (CVE-2009-0663)

Note: After installing this update, pg_getline may return more data than specified by its second argument, as this argument will be ignored. This is consistent with current upstream behavior.
Previously, the length limit (the second argument) was not enforced, allowing a buffer overflow.

A memory leak flaw was found in the function performing the de-quoting of BYTEA type values acquired from a database. An attacker able to cause an application using perl-DBD-Pg to perform a large number of SQL queries returning BYTEA records, could cause the application to use excessive amounts of memory or, possibly, crash. (CVE-2009-1341)

All users of perl-DBD-Pg are advised to upgrade to this updated package, which contains backported patches to fix these issues.
Applications using perl-DBD-Pg must be restarted for the update to take effect.

Multiple vulnerabilities was discovered and corrected in perl-DBD-Pg :

Heap-based buffer overflow in the DBD::Pg module for Perl might allow context-dependent attackers to execute arbitrary code via unspecified input to an application that uses the getline and pg_getline functions to read database rows.

Memory leak in the dequote_bytea function in quote.c in the DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.0.0 for Perl allows context-dependent attackers to cause a denial of service (memory consumption) by fetching data with BYTEA columns (CVE-2009-1341).

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers.

This update provides a fix for these vulnerabilities.

This update of perl-DBD-Pg fixes a heap-based buffer overflow in function pg_db_getline() (CVE-2009-0663) and a denial of service bug that could be triggered remotely (CVE-2009-1341).

The remote Redhat Enterprise Linux 5 host has a package installed that is affected by multiple vulnerabilities as referenced in the RHSA-2009:0479 advisory.

    Perl DBI is a database access Application Programming Interface (API) for     the Perl language. perl-DBD-Pg allows Perl applications to access     PostgreSQL database servers.

    A heap-based buffer overflow flaw was discovered in the pg_getline function     implementation. If the pg_getline or getline functions read large,     untrusted records from a database, it could cause an application using     these functions to crash or, possibly, execute arbitrary code.
    (CVE-2009-0663)

    Note: After installing this update, pg_getline may return more data than     specified by its second argument, as this argument will be ignored. This is     consistent with current upstream behavior. Previously, the length limit     (the second argument) was not enforced, allowing a buffer overflow.

    A memory leak flaw was found in the function performing the de-quoting of     BYTEA type values acquired from a database. An attacker able to cause an     application using perl-DBD-Pg to perform a large number of SQL queries     returning BYTEA records, could cause the application to use excessive     amounts of memory or, possibly, crash. (CVE-2009-1341)

    All users of perl-DBD-Pg are advised to upgrade to this updated package,     which contains backported patches to fix these issues. Applications using     perl-DBD-Pg must be restarted for the update to take effect.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Two vulnerabilities have been discovered in libdbd-pg-perl, the DBI driver module for PostgreSQL database access (DBD::Pg).

  - CVE-2009-0663     A heap-based buffer overflow may allow attackers to     execute arbitrary code through applications which read     rows from the database using the pg_getline and getline     functions. (More common retrieval methods, such as     selectall_arrayref and fetchrow_array, are not     affected.)

  - CVE-2009-1341     A memory leak in the routine which unquotes BYTEA values     returned from the database allows attackers to cause a     denial of service.

ID	Name	Product	Family	Severity
67857	Oracle Linux 5 : perl-DBD-Pg (ELSA-2009-0479)	Nessus	Oracle Linux Local Security Checks	critical
60583	Scientific Linux Security Update : perl-DBD-Pg on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	high
43747	CentOS 5 : perl-DBD-Pg (CESA-2009:0479)	Nessus	CentOS Local Security Checks	high
43609	Mandriva Linux Security Advisory : perl-DBD-Pg (MDVSA-2009:344)	Nessus	Mandriva Local Security Checks	high
39434	openSUSE 10 Security Update : perl-DBD-Pg (perl-DBD-Pg-6227)	Nessus	SuSE Local Security Checks	high
38768	RHEL 5 : perl-DBD-Pg (RHSA-2009:0479)	Nessus	Red Hat Local Security Checks	critical
38202	Debian DSA-1780-1 : libdbd-pg-perl - several vulnerabilities	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2009-0663

critical

Tenable Plugins

critical

high

high

high

high

critical

high