The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

The remote host is affected by the vulnerability described in GLSA-201110-22 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote authenticated attacker could send a specially crafted SQL query       to a PostgreSQL server with the 'intarray' module enabled, possibly       resulting in the execution of arbitrary code with the privileges of the       PostgreSQL server process, or a Denial of Service condition. Furthermore,       a remote authenticated attacker could execute arbitrary Perl code, cause       a Denial of Service condition via different vectors, bypass LDAP       authentication, bypass X.509 certificate validation, gain database       privileges, exploit weak blowfish encryption and possibly cause other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

Multiple security vulnerabilities have been fixed in PostgrSQL

  - allows remote authenticated users to cause a denial of     service. (CVE-2009-3229)

  - allows remote authenticated users to gain higher     privileges. (CVE-2009-3230)

  - when using LDAP authentication with anonymous binds,     allows remote attackers to bypass authentication via an     empty password. (CVE-2009-3231)

Several vulnerabilities have been discovered in PostgreSQL, a SQL database system. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2009-3229     Authenticated users can shut down the backend server by     re-LOAD-ing libraries in $libdir/plugins, if any     libraries are present there. (The old stable     distribution (etch) is not affected by this issue.)

  - CVE-2009-3230     Authenticated non-superusers can gain database superuser     privileges if they can create functions and tables due     to incorrect execution of functions in functional     indexes.

  - CVE-2009-3231     If PostgreSQL is configured with LDAP authentication,     and the LDAP configuration allows anonymous binds, it is     possible for a user to authenticate themselves with an     empty password. (The old stable distribution (etch) is     not affected by this issue.)

In addition, this update contains reliability improvements which do not target security issues.

Multiple security vulnerabilities have been fixed in PostgrSQL

  - CVE-2009-3229: allows remote authenticated users to     cause a denial of service

  - CVE-2009-3230: allows remote authenticated users to gain     higher privileges

  - CVE-2009-3231: when using LDAP authentication with     anonymous binds, allows remote attackers to bypass     authentication via an empty password

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by re-LOAD-ing libraries from a certain plugins directory (CVE-2009-3229).

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600 (CVE-2009-3230).

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password (CVE-2009-3231).

This update provides a fix for this vulnerability.

Update :

Packages for 2008.0 are provided for Corporate Desktop 2008.0 customers

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by re-LOAD-ing libraries from a certain plugins directory (CVE-2009-3229).

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600 (CVE-2009-3230).

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password (CVE-2009-3231).

This update provides a fix for this vulnerability.

Multiple security vulnerabilities have been fixed in PostgreSQL :

  - allows remote authenticated users to cause a denial of     service. (CVE-2009-3229)

  - allows remote authenticated users to gain higher     privileges. (CVE-2009-3230)

  - when using LDAP authentication with anonymous binds,     allows remote attackers to bypass authentication via an     empty password. (CVE-2009-3231)

It was discovered that PostgreSQL could be made to unload and reload an already loaded module by using the LOAD command. A remote authenticated attacker could exploit this to cause a denial of service. This issue did not affect Ubuntu 6.06 LTS. (CVE-2009-3229)

Due to an incomplete fix for CVE-2007-6600, RESET ROLE and RESET SESSION AUTHORIZATION operations were allowed inside security-definer functions. A remote authenticated attacker could exploit this to escalate privileges within PostgreSQL. (CVE-2009-3230)

It was discovered that PostgreSQL did not properly perform LDAP authentication under certain circumstances. When configured to use LDAP with anonymous binds, a remote attacker could bypass authentication by supplying an empty password. This issue did not affect Ubuntu 6.06 LTS. (CVE-2009-3231).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote host is running PostgreSQL, a database application. The version of PostgreSQL is potentially affected by multiple issues : 

  - Authenticated non-superusers can shut down the backend server by re-LOAD-ing libraries in $libdir/plugins, if any libraries are present there.

  - A privilege escalation issue allows some actions to be performed with superuser privileges instead of table owner privileges.  This is related to the fix for CVE-2007-6600 which failed to include protection against misuse of 'RESET SESSION AUTHORIZATION'.

  - If PostgreSQL is configured with LDAP authentication, and your LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password.

Update to PostgreSQL 8.3.8, for various fixes described at http://www.postgresql.org/docs/8.3/static/release-8-3-8.html including three security issues

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL running on the remote host has an authentication bypass vulnerability. If PostgreSQL is using LDAP authentication, and the LDAP server is configured to allow anonymous binds, it may be possible to log into the PostgreSQL server using a blank password. A remote attacker could exploit this to gain access to the database server, possibly as an administrator.

There are reportedly other vulnerabilities in this version of PostgreSQL, though Nessus has not checked for those issues.

ID	Name	Product	Family	Severity
56626	GLSA-201110-22 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
49919	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6535)	Nessus	SuSE Local Security Checks	medium
44765	Debian DSA-1900-1 : postgresql-7.4, postgresql-8.1, postgresql-8.3, postgresql-8.4 - several vulnerabilities	Nessus	Debian Local Security Checks	medium
42031	openSUSE 10 Security Update : postgresql (postgresql-6502)	Nessus	SuSE Local Security Checks	medium
41959	Mandriva Linux Security Advisory : postgresql8.2 (MDVSA-2009:251-1)	Nessus	Mandriva Local Security Checks	medium
41949	MDVSA-2009:177 : postgresql	Nessus	Mandriva Local Security Checks	medium
41939	openSUSE Security Update : postgresql (postgresql-1322)	Nessus	SuSE Local Security Checks	medium
41938	openSUSE Security Update : postgresql (postgresql-1322)	Nessus	SuSE Local Security Checks	medium
41643	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6500)	Nessus	SuSE Local Security Checks	medium
41642	SuSE 11 Security Update : PostgreSQL (SAT Patch Number 1319)	Nessus	SuSE Local Security Checks	medium
41641	SuSE9 Security Update : PostgreSQL (YOU Patch Number 12509)	Nessus	SuSE Local Security Checks	medium
41045	Ubuntu 6.06 LTS / 8.04 LTS / 8.10 / 9.04 : postgresql-8.1, postgresql-8.3 vulnerabilities (USN-834-1)	Nessus	Ubuntu Local Security Checks	medium
5170	PostgreSQL Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
40954	Fedora 10 : postgresql-8.3.8-1.fc10 (2009-9474)	Nessus	Fedora Local Security Checks	medium
40953	Fedora 11 : postgresql-8.3.8-1.fc11 (2009-9473)	Nessus	Fedora Local Security Checks	medium
40947	PostgreSQL LDAP Anonymous Bind Authentication Bypass	Nessus	Databases	medium

Detections

Analytics

CVE-2009-3231

critical

Tenable Plugins

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium