PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to scripts related to "graphical installers for Linux and Mac OS X," which has unspecified impact and attack vectors.

The remote host is missing Mac OS X security update 2013-004 that fixes multiple security issues. 

The remote host is running a version of Mac OS X 10.8 that is older than 10.8.5. The newer version contains numerous security-related fixes for the following components :

  - Apache
  - Bind
  - Certificate Trust Policy
  - CoreGraphics
  - ImageIO
  - Installer
  - IPSec
  - Kernel
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - Power Management
  - QuickTime
  - Screen Lock
  - sudo

 This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit.

 Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.6 or 10.7 that does not have Security Update 2013-004 applied.  This update contains several security-related fixes for the following component :

  - Apache
  - Bind
  - Certificate Trust Policy
  - ClamAV
  - Installer
  - IPSec
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - QuickTime
  - sudo

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The remote host is running a version of Mac OS X 10.8.x that is prior to 10.8.5. The newer version contains multiple security-related fixes for the following components :

  - Apache
  - Bind
  - Certificate Trust Policy
  - CoreGraphics
  - ImageIO
  - Installer
  - IPSec
  - Kernel
  - Mobile Device Management
  - OpenSSL
  - PHP
  - PostgreSQL
  - Power Management
  - QuickTime
  - Screen Lock
  - sudo

This update also addresses an issue in which certain Unicode strings could cause applications to unexpectedly quit.

Note that successful exploitation of the most serious issues could result in arbitrary code execution.

The version of PostgreSQL installed on the remote host is 8.4.x prior to 8.4.17, 9.0.x prior to 9.0.13, 9.1.x prior to 9.1.9, or 9.2.x prior to 9.2.4.  It therefore is potentially affected by multiple vulnerabilities :

  - Enterprise DB's installers for Linux and Mac OS X create     a directory and file in '/tmp' with predictable names.
    (CVE-2013-1902)

  - Enterprise DB's installers for Linux and Mac OS X pass     the database superuser password to a script in an     insecure fashion. (CVE-2013-1903)

Versions of PostgreSQL earlier than 8.3.23 / 8.4.17 / 9.0.13 / 9.1.9 / 9.2.4 and are potentially affected by the following vulnerabilities :

  - An insecure temporary file-creation, specifically occurs when a file with a predictable filename in the '/tmp' directory is created. (CVE-2013-1902)

  - A password disclosure vulnerability occurs due to the application passing the database superuser passwords to a script, specifically exists in the graphical installers package. (CVE-2013-1903)

Versions of PostgreSQL earlier than 9.1.9 or 9.2.4 and are potentially affected by the following vulnerabilities :

  - An information disclosure due to an error in the 'contrib\pgcrypto' functions. (CVE-2013-1900)

  - An insecure temporary file-creation, specifically occurs when a file with a predictable filename in the '/tmp' directory is created. (CVE-2013-1902)

  - A password disclosure vulnerability occurs due to the application passing the database superuser passwords to a script, specifically exists in the graphical installers package. (CVE-2013-1093)

Versions of PostgreSQL earlier than 9.1.9 or 9.2.4 and are potentially affected by the following vulnerabilities :

  - A denial of service when parsing server command-line switches. (CVE-2013-1899)

  - An information disclosure due to an error in the 'contrib\pgcrypto' functions. (CVE-2013-1900)

  - An insecure temporary file-creation, specifically occurs when a file with a predictable filename in the '/tmp' directory is created. (CVE-2013-1902)

  - A password disclosure vulnerability occurs due to the application passing the database superuser passwords to a script, specifically exists in the graphical installers package. (CVE-2013-1093)

Versions of PostgreSQL earlier than 9.1.9 or 9.2.4 and are potentially affected by the following vulnerabilities :

  - A denial of service when parsing server command-line switches. (CVE-2013-1899)

  - An information disclosure due to an error in the 'contrib\pgcrypto' functions. (CVE-2013-1900)

  - Is is prone to a security-bypass, the server component fails to properly handle REPLICATION privilege checks for the current user. (CVE-2013-1901)

  - An insecure temporary file-creation, specifically occurs when a file with a predictable filename in the '/tmp' directory is created. (CVE-2013-1902)

  - A password disclosure vulnerability occurs due to the application passing the database superuser passwords to a script, specifically exists in the graphical installers package. (CVE-2013-1093)

ID	Name	Product	Family	Severity
8008	Mac OS X 10.8 < 10.8.5 Multiple Vulnerabilities (Security Update 2013-004)	Nessus Network Monitor	Web Clients	critical
69878	Mac OS X Multiple Vulnerabilities (Security Update 2013-004)	Nessus	MacOS X Local Security Checks	critical
69877	Mac OS X 10.8.x < 10.8.5 Multiple Vulnerabilities	Nessus	MacOS X Local Security Checks	critical
65854	PostgreSQL 8.4 < 8.4.17 / 9.0 < 9.0.13 / 9.1 < 9.1.9 / 9.2 < 9.2.4 Multiple Vulnerabilities	Nessus	Databases	critical
6747	PostgreSQL < 8.3.23 / 8.4.17 / 9.0.13 / 9.1.9 / 9.2.4 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
6746	PostgreSQL < 8.4.17 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
6745	PostgreSQL < 9.0.13 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
6744	PostgreSQL < 9.1.9 / 9.2.4 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium

Detections

Analytics

CVE-2013-1903

critical

Tenable Plugins

critical

critical

critical

critical

medium

medium

medium

medium