Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL database servers to cause a denial of service (process crash) via format string specifiers in (1) a crafted database warning to the pg_warn function or (2) a crafted DBD statement to the dbd_st_prepare function.

perl-DBD-Pg was prone to format string errors which could crash applications

Two format string flaws were found in perl-DBD-Pg. A specially crafted database warning or error message from a server could cause an application using perl-DBD-Pg to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-1151)

From Red Hat Security Advisory 2012:1116 :

An updated perl-DBD-Pg package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Perl DBI is a database access Application Programming Interface (API) for the Perl language. perl-DBD-Pg allows Perl applications to access PostgreSQL database servers.

Two format string flaws were found in perl-DBD-Pg. A specially crafted database warning or error message from a server could cause an application using perl-DBD-Pg to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-1151)

All users of perl-DBD-Pg are advised to upgrade to this updated package, which contains a backported patch to fix these issues.
Applications using perl-DBD-Pg must be restarted for the update to take effect.

A vulnerability has been discovered and corrected in perl-DBD-Pg :

Two format string flaws were found in the way perl-DBD-Pg. A rogue server could provide a specially crafted database warning or specially crafted DBD statement, which once processed by the perl-DBD-Pg interface would lead to perl-DBD-Pg based process crash (CVE-2012-1151).

The updated packages have been patched to correct this issue.

Update to latest upstream version, fixed the security bug CVE-2012-1151

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Perl DBI is a database access Application Programming Interface (API) for the Perl language. perl-DBD-Pg allows Perl applications to access PostgreSQL database servers.

Two format string flaws were found in perl-DBD-Pg. A specially crafted database warning or error message from a server could cause an application using perl-DBD-Pg to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-1151)

All users of perl-DBD-Pg are advised to upgrade to this updated package, which contains a backported patch to fix these issues.
Applications using perl-DBD-Pg must be restarted for the update to take effect.

The remote Redhat Enterprise Linux 5 / 6 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2012:1116 advisory.

  - perl-DBD-Pg: Format string flaws by turning db notices into Perl warnings and by preparing DBD statement     (CVE-2012-1151)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

An updated perl-DBD-Pg package that fixes two security issues is now available for Red Hat Enterprise Linux 5 and 6.

The Red Hat Security Response Team has rated this update as having moderate security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section.

Perl DBI is a database access Application Programming Interface (API) for the Perl language. perl-DBD-Pg allows Perl applications to access PostgreSQL database servers.

Two format string flaws were found in perl-DBD-Pg. A specially crafted database warning or error message from a server could cause an application using perl-DBD-Pg to crash or, potentially, execute arbitrary code with the privileges of the user running the application. (CVE-2012-1151)

All users of perl-DBD-Pg are advised to upgrade to this updated package, which contains a backported patch to fix these issues.
Applications using perl-DBD-Pg must be restarted for the update to take effect.

The remote host is affected by the vulnerability described in GLSA-201204-08 (Perl DBD-Pg Module: Arbitrary code execution)

    Format string vulnerabilities have been found in the the 'pg_warn()' and       'dbd_st_prepare()' functions in dbdimp.c.
  Impact :

    A remote PostgreSQL server could send specially crafted database       warnings or DBD statements, possibly resulting in execution of arbitrary       code.
  Workaround :

    There is no known workaround at this time.

Niko Tyni discovered two format string vulnerabilities in DBD::Pg, a Perl DBI driver for the PostgreSQL database server, which can be exploited by a rogue database server.

ID	Name	Product	Family	Severity
74579	openSUSE Security Update : perl-DBD-Pg (openSUSE-SU-2012:0422-1)	Nessus	SuSE Local Security Checks	medium
69602	Amazon Linux AMI : perl-DBD-Pg (ALAS-2012-112)	Nessus	Amazon Linux Local Security Checks	medium
68585	Oracle Linux 5 / 6 : perl-DBD-Pg (ELSA-2012-1116)	Nessus	Oracle Linux Local Security Checks	medium
61965	Mandriva Linux Security Advisory : perl-DBD-Pg (MDVSA-2012:112)	Nessus	Mandriva Local Security Checks	medium
61384	Fedora 17 : perl-DBD-Pg-2.19.2-1.fc17 (2012-10892)	Nessus	Fedora Local Security Checks	medium
61383	Fedora 16 : perl-DBD-Pg-2.19.2-1.fc16 (2012-10871)	Nessus	Fedora Local Security Checks	medium
61372	Scientific Linux Security Update : perl-DBD-Pg on SL5.x, SL6.x i386/x86_64 (20120725)	Nessus	Scientific Linux Local Security Checks	medium
60124	RHEL 5 / 6 : perl-DBD-Pg (RHSA-2012:1116)	Nessus	Red Hat Local Security Checks	critical
60121	CentOS 5 / 6 : perl-DBD-Pg (CESA-2012:1116)	Nessus	CentOS Local Security Checks	medium
59624	GLSA-201204-08 : Perl DBD-Pg Module: Arbitrary code execution	Nessus	Gentoo Local Security Checks	medium
58304	Debian DSA-2431-1 : libdbd-pg-perl - format string vulnerabilities	Nessus	Debian Local Security Checks	medium

Detections

Analytics

CVE-2012-1151

critical

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium

critical

medium

medium

medium