PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections when the host name is exactly 32 characters.

The remote Redhat Enterprise Linux 4 host has one or more packages installed that are affected by multiple vulnerabilities that have been acknowledged by the vendor but will not be patched.

  - postgresql: SQL injection due unsanitized newline characters in object names (CVE-2012-0868)

  - CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x     before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER,     which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by     installing the trigger on an attacker-owned table. (CVE-2012-0866)

  - PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to     only 32 characters when verifying SSL certificates, which allows remote attackers to spoof connections     when the host name is exactly 32 characters. (CVE-2012-0867)

Note that Nessus has not tested for these issues but has instead relied on the package manager's report that the package is installed.

Postgresql was updated to the security and bugfix release 9.1.3 :

  - Require execute permission on the trigger function for     'CREATE TRIGGER' (CVE-2012-0866, bnc#749299).

  - Remove arbitrary limitation on length of common name in     SSL certificates (CVE-2012-0867, bnc#749301).

  - Convert newlines to spaces in names written in pg_dump     comments (CVE-2012-0868, bnc#749303).

  - See the release notes for the rest of the changes:
    http://www.postgresql.org/docs/9.1/static/release.html     /usr/share/doc/packages/postgresql/HISTORY

  - This also fixes bnc#701489.

- Security and bugfix release 9.1.3 :

  - Require execute permission on the trigger function for     'CREATE TRIGGER' (CVE-2012-0866, bnc#749299).

  - Remove arbitrary limitation on length of common name in     SSL certificates (CVE-2012-0867, bnc#749301).

  - Convert newlines to spaces in names written in pg_dump     comments (CVE-2012-0868, bnc#749303).

See the release notes for the rest of the changes:
http://www.postgresql.org/docs/9.1/static/release-9-1-3.html /usr/share/doc/packages/postgresql/HISTORY

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

The remote Oracle Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2012-0678 advisory.

    [8.4.11-1]
    - Update to PostgreSQL 8.4.11, for various fixes described at       http://www.postgresql.org/docs/8.4/static/release-8-4-11.html       http://www.postgresql.org/docs/8.4/static/release-8-4-10.html       including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868     Resolves: #812081

Tenable has extracted the preceding description block directly from the Oracle Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Versions of PostgreSQL earlier than 8.4.11 / 9.0.7 / 9.1.3 are potentially affected by multiple vulnerabilities. It therefore is affected by the following vulnerabilities : 

  - Permissions on a function called by a trigger are not properly checked. (CVE-2012-0866)

  - SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances when using third party certificate authorities. (CVE-2012-0867)

  - Line breaks in object names can be exploited to execute arbitrary SQL commands when reloading a pg_dump file. (CVE-2012-0868)

The version of PostgreSQL installed on the remote host is 8.4.x prior to 8.4.11, 9.0.x prior to 9.0.7, or 9.1.x prior to 9.1.3. It is, therefore, potentially affected by multiple vulnerabilities :

  - Permissions on a function called by a trigger are not     properly checked. (CVE-2012-0866)

  - SSL certificate name checks are truncated to 32     characters, allowing connection spoofing under some     circumstances when using third-party certificate     authorities. (CVE-2012-0867)

  - Line breaks in object names can be exploited to execute     arbitrary SQL commands when reloading a pg_dump file.
    (CVE-2012-0868)

The remote host is affected by the vulnerability described in GLSA-201209-24 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could spoof SSL connections. Furthermore, a remote       authenticated attacker could cause a Denial of Service, read and write       arbitrary files, inject SQL commands into dump scripts, or bypass       database restrictions to execute database functions.
    A context-dependent attacker could more easily obtain access via       authentication attempts with an initial substring of the intended       password.
  Workaround :

    There is no known workaround at this time.

PostgreSQL is an advanced object-relational database management system (DBMS).

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

These updated packages upgrade PostgreSQL to version 8.4.11, which fixes these issues as well as several data-corruption issues and lesser non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

The remote Redhat Enterprise Linux 5 / 6 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2012:0678 advisory.

    PostgreSQL is an advanced object-relational database management system     (DBMS).

    The pg_dump utility inserted object names literally into comments in the     SQL script it produces. An unprivileged database user could create an     object whose name includes a newline followed by an SQL command. This SQL     command might then be executed by a privileged user during later restore of     the backup dump, allowing privilege escalation. (CVE-2012-0868)

    When configured to do SSL certificate verification, PostgreSQL only checked     the first 31 characters of the certificate's Common Name field. Depending     on the configuration, this could allow an attacker to impersonate a server     or a client using a certificate from a trusted Certificate Authority issued     for a different name. (CVE-2012-0867)

    CREATE TRIGGER did not do a permissions check on the trigger function to     be called. This could possibly allow an authenticated database user to     call a privileged trigger function on data of their choosing.
    (CVE-2012-0866)

    These updated packages upgrade PostgreSQL to version 8.4.11, which fixes     these issues as well as several data-corruption issues and lesser     non-security issues. Refer to the PostgreSQL Release Notes for a full list     of changes:

    http://www.postgresql.org/docs/8.4/static/release.html

    All PostgreSQL users are advised to upgrade to these updated packages,     which correct these issues. If the postgresql service is running, it will     be automatically restarted after installing this update.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

Updated postgresql84 and postgresql packages that fix three security issues are now available for Red Hat Enterprise Linux 5 and 6 respectively.

The Red Hat Security Response Team has rated this update as having moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

The pg_dump utility inserted object names literally into comments in the SQL script it produces. An unprivileged database user could create an object whose name includes a newline followed by a SQL command.
This SQL command might then be executed by a privileged user during later restore of the backup dump, allowing privilege escalation.
(CVE-2012-0868)

When configured to do SSL certificate verification, PostgreSQL only checked the first 31 characters of the certificate's Common Name field. Depending on the configuration, this could allow an attacker to impersonate a server or a client using a certificate from a trusted Certificate Authority issued for a different name. (CVE-2012-0867)

CREATE TRIGGER did not do a permissions check on the trigger function to be called. This could possibly allow an authenticated database user to call a privileged trigger function on data of their choosing.
(CVE-2012-0866)

These updated packages upgrade PostgreSQL to version 8.4.11, which fixes these issues as well as several data-corruption issues and lesser non-security issues. Refer to the PostgreSQL Release Notes for a full list of changes :

http://www.postgresql.org/docs/8.4/static/release.html

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

Update to latest Postgres releases --- resolves some security and data loss bugs http://www.postgresql.org/docs/9.1/static/release-9-1-3.html http://www.postgresql.org/docs/9.0/static/release-9-0-7.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple vulnerabilities has been discovered and corrected in postgresql :

Permissions on a function called by a trigger are not properly checked (CVE-2012-0866).

SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances when using third-party certificate authorities (CVE-2012-0867).

Line breaks in object names can be exploited to execute arbitrary SQL when reloading a pg_dump file (CVE-2012-0868).

This advisory provides the latest versions of PostgreSQL that is not vulnerable to these issues.

It was discovered that PostgreSQL incorrectly checked permissions on functions called by a trigger. An attacker could attach a trigger to a table they owned and possibly escalate privileges. (CVE-2012-0866)

It was discovered that PostgreSQL incorrectly truncated SSL certificate name checks to 32 characters. If a host name was exactly 32 characters, this issue could be exploited by an attacker to spoof the SSL certificate. This issue affected Ubuntu 10.04 LTS, Ubuntu 10.10, Ubuntu 11.04 and Ubuntu 11.10. (CVE-2012-0867)

It was discovered that the PostgreSQL pg_dump utility incorrectly filtered line breaks in object names. An attacker could create object names that execute arbitrary SQL commands when a dump script is reloaded. (CVE-2012-0868).

Note that Tenable Network Security has extracted the preceding description block directly from the Ubuntu security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The PostgreSQL Global Development Group reports :

These vulnerabilities could allow users to define triggers that execute functions on which the user does not have EXECUTE permission, allow SSL certificate spoofing and allow line breaks in object names to be exploited to execute code when loading a pg_dump file.

Versions of PostgreSQL earlier than 9.1.3, 9.0.7, 8.4.11 and are potentially affected by the following vulnerabilities :

  - Permissions on a function called by a trigger are not properly checked. (CVE-2012-0866)

  - SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances when using third party certificates. (CVE-2012-0867)

  - Line breaks in object names can be exploited to execute arbitrary SQL when reloading a pg_dump file. (CVE-2012-0868)

Versions of PostgreSQL 8.3.x earlier than 8.3.18 are potentially affected by the following vulnerabilities :

  - Permissions on a function called by a trigger are not properly checked. (CVE-2012-0866)

  - SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances when using third party certificates. (CVE-2012-0867)

  - Line breaks in object names can be exploited to execute arbitrary SQL when reloading a pg_dump file. (CVE-2012-0868)

Several local vulnerabilities have been discovered in PostgreSQL, an object-relational SQL database. The Common Vulnerabilities and Exposures project identifies the following problems :

  - CVE-2012-0866     It was discovered that the permissions of a function     called by a trigger are not checked. This could result     in privilege escalation.

  - CVE-2012-0867     It was discovered that only the first 32 characters of a     host name are checked when validating host names through     SSL certificates. This could result in spoofing the     connection in limited circumstances.

  - CVE-2012-0868     It was discovered that pg_dump did not sanitise object     names. This could result in arbitrary SQL command     execution if a malformed dump file is opened.

ID	Name	Product	Family	Severity
198849	RHEL 4 : postgresql (Unpatched Vulnerability)	Nessus	Red Hat Local Security Checks	critical
74756	openSUSE Security Update : postgresql (openSUSE-SU-2012:1173-1)	Nessus	SuSE Local Security Checks	medium
74591	openSUSE Security Update : postgresql (openSUSE-SU-2012:0480-1)	Nessus	SuSE Local Security Checks	medium
69689	Amazon Linux AMI : postgresql8 (ALAS-2012-82)	Nessus	Amazon Linux Local Security Checks	medium
68529	Oracle Linux 5 / 6 : postgresql / and / postgresql84 (ELSA-2012-0678)	Nessus	Oracle Linux Local Security Checks	critical
6817	PostgreSQL < 8.4.11 / 9.0.7 / 9.1.3 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
63352	PostgreSQL 8.4 < 8.4.11 / 9.0 < 9.0.7 / 9.1 < 9.1.3 Multiple Vulnerabilities	Nessus	Databases	medium
62380	GLSA-201209-24 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	medium
61316	Scientific Linux Security Update : postgresql and postgresql84 on SL5.x, SL6.x i386/x86_64 (20120521)	Nessus	Scientific Linux Local Security Checks	medium
59223	RHEL 5 / 6 : postgresql and postgresql84 (RHSA-2012:0678)	Nessus	Red Hat Local Security Checks	critical
59214	CentOS 5 / 6 : postgresql / postgresql84 (CESA-2012:0678)	Nessus	CentOS Local Security Checks	medium
58282	Fedora 16 : postgresql-9.1.3-1.fc16 (2012-2591)	Nessus	Fedora Local Security Checks	medium
58281	Fedora 15 : postgresql-9.0.7-1.fc15 (2012-2589)	Nessus	Fedora Local Security Checks	medium
58257	Fedora 17 : postgresql-9.1.3-1.fc17 (2012-2508)	Nessus	Fedora Local Security Checks	medium
58177	Mandriva Linux Security Advisory : postgresql (MDVSA-2012:026)	Nessus	Mandriva Local Security Checks	medium
58168	Ubuntu 8.04 LTS / 10.04 LTS / 10.10 / 11.04 / 11.10 : postgresql-8.3, postgresql-8.4, postgresql-9.1 vulnerabilities (USN-1378-1)	Nessus	Ubuntu Local Security Checks	medium
58162	FreeBSD : databases/postgresql*-client -- multiple vulnerabilities (174b8864-6237-11e1-be18-14dae938ec40)	Nessus	FreeBSD Local Security Checks	medium
6337	PostgreSQL < 9.1.3 / 9.0.7 / 8.4.11 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
6336	PostgreSQL 8.3.x < 8.3.18 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
58135	Debian DSA-2418-1 : postgresql-8.4 - several vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-0867

high

Tenable Plugins

critical

medium

medium

medium

critical

medium

medium

medium

medium

critical

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium