Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2015:2083 advisory.

    PostgreSQL is an advanced object-relational database management system     (DBMS).

    A memory leak error was discovered in the crypt() function of the pgCrypto     extension. An authenticated attacker could possibly use this flaw to     disclose a limited amount of the server memory. (CVE-2015-5288)

    A stack overflow flaw was discovered in the way the PostgreSQL core server     processed certain JSON or JSONB input. An authenticated attacker could     possibly use this flaw to crash the server backend by sending specially     crafted JSON or JSONB input. (CVE-2015-5289)

    Please note that SSL renegotiation is now disabled by default. For more     information, please refer to PostgreSQL's 2015-10-08 Security Update     Release notes, linked to in the References section.

    All PostgreSQL users are advised to upgrade to these updated packages,     which correct these issues. If the postgresql92-postgresql service is     running, it will be automatically restarted after installing this update.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote host is affected by the vulnerability described in GLSA-201701-33 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or       escalate privileges.
  Workaround :

    There is no known workaround at this time.

The version of PostgreSQL installed on the remote host is 9.3.x prior to 9.3.10, or 9.4.x prior to 9.4.5 and is affected by a denial of service (DoS) vulnerability. This may allow an authenticated attacker to cause the server to crash when handling the specially crafted JSON request.

This update for postgresql94 fixes the following issues :

  - Security and bugfix release 9.4.6 :

  - *** IMPORTANT *** Users of version 9.4 will need to     reindex any jsonb_path_ops indexes they have created, in     order to fix a persistent issue with missing index     entries.

  - Fix infinite loops and buffer-overrun problems in     regular expressions (CVE-2016-0773, bsc#966436).

  - Fix regular-expression compiler to handle loops of     constraint arcs (CVE-2007-4772).

  - Prevent certain PL/Java parameters from being set by     non-superusers (CVE-2016-0766, bsc#966435).

  - Fix many issues in pg_dump with specific object types

  - Prevent over-eager pushdown of HAVING clauses for     GROUPING SETS

  - Fix deparsing error with ON CONFLICT ... WHERE clauses

  - Fix tableoid errors for postgres_fdw

  - Prevent floating-point exceptions in pgbench

  - Make \det search Foreign Table names consistently

  - Fix quoting of domain constraint names in pg_dump

  - Prevent putting expanded objects into Const nodes

  - Allow compile of PL/Java on Windows

  - Fix 'unresolved symbol' errors in PL/Python execution

  - Allow Python2 and Python3 to be used in the same     database

  - Add support for Python 3.5 in PL/Python

  - Fix issue with subdirectory creation during initdb

  - Make pg_ctl report status correctly on Windows

  - Suppress confusing error when using pg_receivexlog with     older servers

  - Multiple documentation corrections and additions

  - Fix erroneous hash calculations in     gin_extract_jsonb_path()

  - For the full release notse, see:
    http://www.postgresql.org/docs/9.4/static/release-9-4-6.
    html

  - Security and bugfix release 9.4.5 :

  - CVE-2015-5289, bsc#949670: json or jsonb input values     constructed from arbitrary user input can crash the     PostgreSQL server and cause a denial of service.

  - CVE-2015-5288, bsc#949669: The crypt() function included     with the optional pgCrypto extension could be exploited     to read a few additional bytes of memory. No working     exploit for this issue has been developed.

  - For the full release notse, see:
    http://www.postgresql.org/docs/current/static/release-9-     4-5.html

  - Relax dependency on libpq to major version.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

update to 9.4.5 per release notes http://www.postgresql.org/docs/9.4/static/release-9-4-5.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update of postgresql94 to 9.4.5 fixes the following issues :

  - CVE-2015-5289: json or jsonb input values constructed     from arbitrary user input could have crashed the     PostgreSQL server and caused a denial of service     (bsc#949670)

  - CVE-2015-5288: crypt() (pgCrypto extension) couldi     potentially be exploited to read a few additional bytes     of memory (bsc#949669)

Also contains all changes and bugfixes in the upstream 9.4.5 release:
http://www.postgresql.org/docs/current/static/release-9-4-5.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

A memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory.
(CVE-2015-5288)

A stack overflow flaw was discovered in the way the PostgreSQL core server processed certain JSON or JSONB input. An authenticated attacker could possibly use this flaw to crash the server backend by sending specially crafted JSON or JSONB input. (CVE-2015-5289)

If the postgresql service is running, it will be automatically restarted after installing this update.

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

A memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory.
(CVE-2015-5288)

A stack overflow flaw was discovered in the way the PostgreSQL core server processed certain JSON or JSONB input. An authenticated attacker could possibly use this flaw to crash the server backend by sending specially crafted JSON or JSONB input. (CVE-2015-5289)

Please note that SSL renegotiation is now disabled by default. For more information, please refer to PostgreSQL's 2015-10-08 Security Update Release notes, linked to in the References section.

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

From Red Hat Security Advisory 2015:2078 :

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Moderate security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section.

PostgreSQL is an advanced object-relational database management system (DBMS).

A memory leak error was discovered in the crypt() function of the pgCrypto extension. An authenticated attacker could possibly use this flaw to disclose a limited amount of the server memory.
(CVE-2015-5288)

A stack overflow flaw was discovered in the way the PostgreSQL core server processed certain JSON or JSONB input. An authenticated attacker could possibly use this flaw to crash the server backend by sending specially crafted JSON or JSONB input. (CVE-2015-5289)

Please note that SSL renegotiation is now disabled by default. For more information, please refer to PostgreSQL's 2015-10-08 Security Update Release notes, linked to in the References section.

All PostgreSQL users are advised to upgrade to these updated packages, which correct these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash) via unspecified vectors, which are not properly handled in (1) json or (2) jsonb values.
(CVE-2015-5289)

The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a 'too-short' salt.
(CVE-2015-5288)

postgresql93 was updated to version 9.3.10 to fix two security issues.

These security issues were fixed :

  - CVE-2015-5288: Unchecked JSON input can crash the server     (bsc#949669).

  - CVE-2015-5289: Memory leak in crypt() function     (bsc#949670).

For the full release notes, please see:
http://www.postgresql.org/docs/current/static/release-9-3-10.html

The PostreSQL database postgresql93 was updated to the bugfix release 9.3.10 :

Security issues fixed :

  - CVE-2015-5289, bsc#949670: json or jsonb input values     constructed from arbitrary user input can crash the     PostgreSQL server and cause a denial of service.

  - CVE-2015-5288, bsc#949669: The crypt() function included     with the optional pgCrypto extension could be exploited     to read a few additional bytes of memory. No working     exploit for this issue has been developed.

For the full release notes, see:
http://www.postgresql.org/docs/current/static/release-9-3-10.html

Other bugs fixed :

  - Move systemd related stuff and user creation to     postgresql-init.

  - Remove some obsolete %suse_version conditionals.

  - Relax dependency on libpq to major version.

  - Fix possible failure to recover from an inconsistent     database state. See full release notes for details.

  - Fix rare failure to invalidate relation cache init file.

  - Avoid deadlock between incoming sessions and CREATE/DROP     DATABASE.

  - Improve planner's cost estimates for semi-joins and     anti-joins with inner indexscans

  - For the full release notes for 9.3.9 see:
    http://www.postgresql.org/docs/9.3/static/release-9-3-9.
    html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system.

  - CVE-2015-5288     Josh Kupershmidt discovered a vulnerability in the     crypt() function in the pgCrypto extension. Certain     invalid salt arguments can cause the server to crash or     to disclose a few bytes of server memory.

  - CVE-2015-5289     Oskari Saarenmaa discovered that json or jsonb input     values constructed from arbitrary user input can crash     the PostgreSQL server and cause a denial of service.

The version of PostgreSQL installed on the remote host is 9.0.x prior to 9.0.23, 9.1.x prior to 9.1.19, 9.2.x prior to 9.2.14, 9.3.x prior to 9.3.10, or 9.4.x prior to 9.4.5. It is, therefore, affected by multiple vulnerabilities :

  - A denial of service vulnerability exists due to an     unspecified flaw in the crypt() function. An     authenticated, remote attacker can exploit this to cause     a memory leak, resulting in a denial of service     condition. (CVE-2015-5288)

  - A denial of service vulnerability exists due to improper     validation of user-supplied JSON input. An     authenticated, remote attacker can exploit this, via     specially crafted JSON input, to cause the server to     crash. (CVE-2015-5289)

  - A denial of service vulnerability exists due to a flaw     that is triggered when a function is executed in an     outer-subtransaction cursor. An authenticated, remote     attacker can exploit this to cause a denial of service     condition.

  - Multiple stack overflow conditions exist due to improper     validation of user-supplied input when handling input to     record types, range types, json, jsonb, tsquery,     ltxtquery and query_int. An authenticated, remote     attacker can exploit this to cause a denial of service     condition and potentially remote code execution.

  - An information disclosure vulnerability exists due to     world-readable permissions granted to temporary files     that are created during a pg_dump with tar-format     output. A local attacker can exploit this disclose     sensitive information.

  - An overflow condition exists due to improper validation     of user-supplied input when handling SIMILAR TO and LIKE     matching regular expressions. An authenticated, remote     attacker can exploit this to cause a stack overflow,     resulting in a denial of service condition.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2772-1 advisory.

    Josh Kupershmidt discovered the pgCrypto extension could expose several bytes of server memory if the     crypt() function was provided a too-short salt. An attacker could use this flaw to read private data.
    (CVE-2015-5288)

    Oskari Saarenmaa discovered that the json and jsonb handlers could exhaust available stack space. An     attacker could use this flaw to perform a denial of service attack. This issue only affected Ubuntu 14.04     LTS and Ubuntu 15.04. (CVE-2015-5289)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

PostgreSQL project reports :

Two security issues have been fixed in this release which affect users of specific PostgreSQL features.

- CVE-2015-5289 json or jsonb input values constructed from arbitrary user input can crash the PostgreSQL server and cause a denial of service.

- CVE-2015-5288: The crypt() function included with the optional pgCrypto extension could be exploited to read a few additional bytes of memory. No working exploit for this issue has been developed.

ID	Name	Product	Family	Severity
210218	RHEL 6 / 7 : postgresql92-postgresql (RHSA-2015:2083)	Nessus	Red Hat Local Security Checks	medium
96474	GLSA-201701-33 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
9263	PostgreSQL 9.3 < 9.3.10 / 9.4 < 9.4.5 DoS	Nessus Network Monitor	Database	medium
89730	SUSE SLED11 / SLES11 Security Update : postgresql94 (SUSE-SU-2016:0677-1)	Nessus	SuSE Local Security Checks	high
89301	Fedora 23 : postgresql-9.4.5-1.fc23 (2015-7fac92f49c)	Nessus	Fedora Local Security Checks	medium
89268	Fedora 22 : postgresql-9.4.5-1.fc22 (2015-6d2a957a87)	Nessus	Fedora Local Security Checks	medium
88835	SUSE SLED11 / SLES11 Security Update : postgresql94 (SUSE-SU-2016:0482-1)	Nessus	SuSE Local Security Checks	medium
86992	Scientific Linux Security Update : postgresql on SL7.x srpm/x86_64 (20151119)	Nessus	Scientific Linux Local Security Checks	medium
86966	RHEL 7 : postgresql (RHSA-2015:2078)	Nessus	Red Hat Local Security Checks	medium
86925	Oracle Linux 7 : postgresql (ELSA-2015-2078)	Nessus	Oracle Linux Local Security Checks	medium
86917	CentOS 7 : postgresql (CESA-2015:2078)	Nessus	CentOS Local Security Checks	medium
86771	Amazon Linux AMI : postgresql92 / postgresql93,postgresql94 (ALAS-2015-609)	Nessus	Amazon Linux Local Security Checks	medium
86736	openSUSE Security Update : postgresql93 (openSUSE-2015-701)	Nessus	SuSE Local Security Checks	medium
86627	SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2015:1821-1)	Nessus	SuSE Local Security Checks	medium
86447	Debian DSA-3374-1 : postgresql-9.4 - security update	Nessus	Debian Local Security Checks	medium
86422	PostgreSQL 9.0.x < 9.0.23 / 9.1.x < 9.1.19 / 9.2.x < 9.2.14 / 9.3.x < 9.3.10 / 9.4.x < 9.4.5 Multiple Vulnerabilities	Nessus	Databases	medium
86416	Ubuntu 14.04 LTS : PostgreSQL vulnerabilities (USN-2772-1)	Nessus	Ubuntu Local Security Checks	medium
86320	FreeBSD : PostgreSQL -- minor security problems. (a0182578-6e00-11e5-a90c-0026551a22dc)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-5289

medium

Tenable Plugins

medium

high

medium

high

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium