Buffer overflow in the gettoken function in contrib/intarray/_int_bool.c in the intarray array module in PostgreSQL 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14, and 8.2.x before 8.2.20 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via integers with a large number of digits to unspecified functions.

A buffer overflow in the intarray module potentially allowed attackers to execute arbitrary code as the user running postgresql (CVE-2010-4015:CVSS v2 Base Score: 4.9). Additionally a possible log forging problem was fixed too. (CVE-2010-4014)

According to the version of one or more Juniper NSM servers running on the remote host, it is potentially vulnerable to multiple vulnerabilities, the worst of which may allow an authenticated user to trigger a denial of service condition or execute arbitrary code.

From Red Hat Security Advisory 2011:0198 :

Updated postgresql84 packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

A stack-based buffer overflow flaw was found in the way PostgreSQL processed certain tokens from a SQL query when the intarray module was enabled on a particular database. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server.
(CVE-2010-4015)

Red Hat would like to thank Geoff Keating of the Apple Product Security team for reporting this issue.

These updated postgresql84 packages upgrade PostgreSQL to version 8.4.7. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.

The remote Oracle Linux 5 / 6 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2011-0197 advisory.

    - Update to PostgreSQL 8.4.7, for various fixes described at       http://www.postgresql.org/docs/8.4/static/release-8-4-7.html       http://www.postgresql.org/docs/8.4/static/release-8-4-6.html       including the fix for CVE-2010-4015     Resolves: #672634
    - Update to PostgreSQL 8.4.5, for various fixes described at       http://www.postgresql.org/docs/8.4/static/release-8-4-5.html       including the fix for CVE-2010-3433     Resolves: #640069

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The version of PostgreSQL installed on the remote host is 8.2.x prior to 8.2.20, 8.3.x prior to 8.3.14, 8.4.x prior to 8.4.7, or 9.0.x prior to 9.0.3.  It therefore is potentially affected by a buffer overflow vulnerability. 

By calling functions from the intarray optional module with certain parameters, a remote, authenticated attacker could execute arbitrary code on the remote host subject to the privileges of the user running the affected application.

A stack-based buffer overflow flaw was found in the way PostgreSQL processed certain tokens from a SQL query when the intarray module was enabled on a particular database. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server.
(CVE-2010-4015)

For Scientific Linux 4, the updated postgresql packages contain a backported patch for this issue; there are no other changes.

For Scientific Linux 5, the updated postgresql packages upgrade PostgreSQL to version 8.1.23, and contain a backported patch for this issue. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.1/static/release.html

If the postgresql service is running, it will be automatically restarted after installing this update.

A stack-based buffer overflow flaw was found in the way PostgreSQL processed certain tokens from a SQL query when the intarray module was enabled on a particular database. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server.
(CVE-2010-4015)

These updated postgresql84 packages upgrade PostgreSQL to version 8.4.7. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

If the postgresql service is running, it will be automatically restarted after installing this update.

A buffer overflow in the intarray module potentially allowed attackers to execute arbitrary code as the user running postgresql.
(CVE-2010-4015:CVSS v2 Base Score: 4.9)

Additionally a possible log forging problem was fixed too.
(CVE-2010-4014)

The remote host is affected by the vulnerability described in GLSA-201110-22 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote authenticated attacker could send a specially crafted SQL query       to a PostgreSQL server with the 'intarray' module enabled, possibly       resulting in the execution of arbitrary code with the privileges of the       PostgreSQL server process, or a Denial of Service condition. Furthermore,       a remote authenticated attacker could execute arbitrary Perl code, cause       a Denial of Service condition via different vectors, bypass LDAP       authentication, bypass X.509 certificate validation, gain database       privileges, exploit weak blowfish encryption and possibly cause other       unspecified impact.
  Workaround :

    There is no known workaround at this time.

Updated postgresql84 packages that fix one security issue are now available for Red Hat Enterprise Linux 5.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

A stack-based buffer overflow flaw was found in the way PostgreSQL processed certain tokens from a SQL query when the intarray module was enabled on a particular database. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server.
(CVE-2010-4015)

Red Hat would like to thank Geoff Keating of the Apple Product Security team for reporting this issue.

These updated postgresql84 packages upgrade PostgreSQL to version 8.4.7. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.

A buffer overflow in the intarray module potentially allowed attackers to execute arbitrary code as the user running PostgreSQL (CVE-2010-4015: CVSS v2 Base Score: 4.9). Additionally a possible log forging problem was fixed too. (CVE-2010-4014)

Update to PostgreSQL 8.4.7, for various fixes described at http://www.postgresql.org/docs/8.4/static/release-8-4-7.html including the fix for CVE-2010-4015

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A vulnerability was discovered and corrected in postgresql :

Buffer overflow in the gettoken function in contrib/intarray/_int_bool.c in the intarray array module in PostgreSQL 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14, and 8.2.x before 8.2.20 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via integers with a large number of digits to unspecified functions (CVE-2010-4015).

Packages for 2009.0 are provided as of the Extended Maintenance Program. Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149 products_id=490

This update provides a solution to this vulnerability.

Updated postgresql packages that fix one security issue are now available for Red Hat Enterprise Linux 4, 5, and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

A stack-based buffer overflow flaw was found in the way PostgreSQL processed certain tokens from a SQL query when the intarray module was enabled on a particular database. An authenticated database user running a specially crafted SQL query could use this flaw to cause a temporary denial of service (postgres daemon crash) or, potentially, execute arbitrary code with the privileges of the database server.
(CVE-2010-4015)

Red Hat would like to thank Geoff Keating of the Apple Product Security team for reporting this issue.

For Red Hat Enterprise Linux 4, the updated postgresql packages contain a backported patch for this issue; there are no other changes.

For Red Hat Enterprise Linux 5, the updated postgresql packages upgrade PostgreSQL to version 8.1.23, and contain a backported patch for this issue. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.1/static/release.html

For Red Hat Enterprise Linux 6, the updated postgresql packages upgrade PostgreSQL to version 8.4.7, which includes a fix for this issue. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct this issue. If the postgresql service is running, it will be automatically restarted after installing this update.

Geoff Keating reported that a buffer overflow exists in the intarray module's input function for the query_int type. This could allow an attacker to cause a denial of service or possibly execute arbitrary code as the postgres user.

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The remote Redhat Enterprise Linux 5 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2011:0198 advisory.

    PostgreSQL is an advanced object-relational database management system     (DBMS).

    A stack-based buffer overflow flaw was found in the way PostgreSQL     processed certain tokens from an SQL query when the intarray module was     enabled on a particular database. An authenticated database user running a     specially-crafted SQL query could use this flaw to cause a temporary denial     of service (postgres daemon crash) or, potentially, execute arbitrary code     with the privileges of the database server. (CVE-2010-4015)

    Red Hat would like to thank Geoff Keating of the Apple Product Security     team for reporting this issue.

    These updated postgresql84 packages upgrade PostgreSQL to version 8.4.7.
    Refer to the PostgreSQL Release Notes for a full list of changes:

    http://www.postgresql.org/docs/8.4/static/release.html

    All PostgreSQL users are advised to upgrade to these updated packages,     which correct this issue. If the postgresql service is running, it will be     automatically restarted after installing this update.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

It was discovered that PostgreSQL's intarray contrib module does not properly handle integers with a large number of digits, leading to a server crash and potentially arbitrary code execution.

Versions of PostgreSQL earlier than 9.0.3, 8.4.7, 8.3.14, or 8.2.20 are potentially affected by a buffer overflow vulnerability in the contrib module intarray's input function for the query_int type.  An attacker, exploiting this flaw, could potentially execute arbitrary code on the remote host subject to the privileges of the user running the affected application.

ID	Name	Product	Family	Severity
75713	openSUSE Security Update : postgresql (openSUSE-SU-2011:0254-1)	Nessus	SuSE Local Security Checks	medium
69872	Juniper NSM Servers < 2012.1 Multiple Vulnerabilities	Nessus	Misc.	high
68194	Oracle Linux 5 : postgresql84 (ELSA-2011-0198)	Nessus	Oracle Linux Local Security Checks	medium
68193	Oracle Linux 5 / 6 : postgresql (ELSA-2011-0197)	Nessus	Oracle Linux Local Security Checks	critical
63351	PostgreSQL 8.2 < 8.2.20 / 8.3 < 8.3.14 / 8.4 < 8.4.7 / 9.0 < 9.0.3 Buffer Overflow Vulnerability	Nessus	Databases	medium
60951	Scientific Linux Security Update : postgresql on SL4.x, SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
60950	Scientific Linux Security Update : postgresql84 on SL5.x i386/x86_64	Nessus	Scientific Linux Local Security Checks	medium
57244	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 7404)	Nessus	SuSE Local Security Checks	medium
56626	GLSA-201110-22 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
53793	openSUSE Security Update : postgresql (openSUSE-SU-2011:0254-1)	Nessus	SuSE Local Security Checks	medium
53417	CentOS 5 : postgresql84 (CESA-2011:0198)	Nessus	CentOS Local Security Checks	medium
53237	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 7341)	Nessus	SuSE Local Security Checks	medium
53230	SuSE 11.1 Security Update : PostgreSQL (SAT Patch Number 3977)	Nessus	SuSE Local Security Checks	medium
51927	Fedora 13 : postgresql-8.4.7-1.fc13 (2011-0963)	Nessus	Fedora Local Security Checks	medium
51898	Mandriva Linux Security Advisory : postgresql (MDVSA-2011:021)	Nessus	Mandriva Local Security Checks	medium
51897	Fedora 14 : postgresql-8.4.7-1.fc14 (2011-0990)	Nessus	Fedora Local Security Checks	medium
51888	CentOS 4 / 5 : postgresql (CESA-2011:0197)	Nessus	CentOS Local Security Checks	medium
51871	Ubuntu 6.06 LTS / 8.04 LTS / 9.10 / 10.04 LTS / 10.10 : postgresql-8.1, postgresql-8.3, postgresql-8.4 vulnerability (USN-1058-1)	Nessus	Ubuntu Local Security Checks	medium
51869	RHEL 5 : postgresql84 (RHSA-2011:0198)	Nessus	Red Hat Local Security Checks	critical
51868	RHEL 4 / 5 / 6 : postgresql (RHSA-2011:0197)	Nessus	Red Hat Local Security Checks	medium
51862	Debian DSA-2157-1 : postgresql-8.3, postgresql-8.4, postgresql-9.0 - buffer overflow	Nessus	Debian Local Security Checks	medium
5757	PostgreSQL < 9.0.3 / 8.4.7 / 8.3.14 / 8.2.20 Code Execution Vulnerability	Nessus Network Monitor	Database	medium

Detections

Analytics

CVE-2010-4015

critical

Tenable Plugins

medium

high

medium

critical

medium

medium

medium

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium