PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.

The remote host is affected by the vulnerability described in GLSA-201701-33 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the CVE identifiers referenced below for details.
  Impact :

    A remote attacker could possibly execute arbitrary code with the       privileges of the process, cause a Denial of Service condition, or       escalate privileges.
  Workaround :

    There is no known workaround at this time.

The version of PostgreSQL installed on the remote host is 9.1.x prior to 9.1.20, 9.2.x prior to 9.2.15, 9.3.x prior to 9.3.11, or 9.4.x prior to 9.4.6, or 9.5.x prior to 9.5.1 and is affected by multiple vulnerabilities :

 - An integer overflow condition exists that is triggered as user-supplied input is not properly validated when handling regular expressions. This may allow an attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists in the 'init_custom_variable()' function in 'backend/utils/misc/guc.c' that is triggered during the handling of PL/Java. This may allow an attacker to gain elevated privileges.
 - A flaw exists related to certain security definer functions or when a common user and query is planned initially and reused across multiple SET ROLEs. This may allow an authenticated attacker to cause incorrect policies to be applied in cases where role-specific polices are used.
 - A flaw exists in 'contrib/pageinspect/brinfuncs.c' that is triggered during the use of pageinspect functions on BRIN index pages. This may allow an authenticated attacker to cause a crash or gain access to a small amount of server memory information, which may potentially contain credential information.

This update for postgresql94 fixes the following issues :

  - Security and bugfix release 9.4.6 :

  - *** IMPORTANT *** Users of version 9.4 will need to     reindex any jsonb_path_ops indexes they have created, in     order to fix a persistent issue with missing index     entries.

  - Fix infinite loops and buffer-overrun problems in     regular expressions (CVE-2016-0773, bsc#966436).

  - Fix regular-expression compiler to handle loops of     constraint arcs (CVE-2007-4772).

  - Prevent certain PL/Java parameters from being set by     non-superusers (CVE-2016-0766, bsc#966435).

  - Fix many issues in pg_dump with specific object types

  - Prevent over-eager pushdown of HAVING clauses for     GROUPING SETS

  - Fix deparsing error with ON CONFLICT ... WHERE clauses

  - Fix tableoid errors for postgres_fdw

  - Prevent floating-point exceptions in pgbench

  - Make \det search Foreign Table names consistently

  - Fix quoting of domain constraint names in pg_dump

  - Prevent putting expanded objects into Const nodes

  - Allow compile of PL/Java on Windows

  - Fix 'unresolved symbol' errors in PL/Python execution

  - Allow Python2 and Python3 to be used in the same     database

  - Add support for Python 3.5 in PL/Python

  - Fix issue with subdirectory creation during initdb

  - Make pg_ctl report status correctly on Windows

  - Suppress confusing error when using pg_receivexlog with     older servers

  - Multiple documentation corrections and additions

  - Fix erroneous hash calculations in     gin_extract_jsonb_path()

  - For the full release notse, see:
    http://www.postgresql.org/docs/9.4/static/release-9-4-6.
    html

  - Security and bugfix release 9.4.5 :

  - CVE-2015-5289, bsc#949670: json or jsonb input values     constructed from arbitrary user input can crash the     PostgreSQL server and cause a denial of service.

  - CVE-2015-5288, bsc#949669: The crypt() function included     with the optional pgCrypto extension could be exploited     to read a few additional bytes of memory. No working     exploit for this issue has been developed.

  - For the full release notse, see:
    http://www.postgresql.org/docs/current/static/release-9-     4-5.html

  - Relax dependency on libpq to major version.

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql94 fixes the following issues :

  - Security and bugfix release 9.4.6 :

  - *** IMPORTANT *** Users of version 9.4 will need to     reindex any jsonb_path_ops indexes they have created, in     order to fix a persistent issue with missing index     entries.

  - Fix infinite loops and buffer-overrun problems in     regular expressions (CVE-2016-0773, bsc#966436).

  - Fix regular-expression compiler to handle loops of     constraint arcs (CVE-2007-4772).

  - Prevent certain PL/Java parameters from being set by     non-superusers (CVE-2016-0766, bsc#966435).

  - Fix many issues in pg_dump with specific object types

  - Prevent over-eager pushdown of HAVING clauses for     GROUPING SETS

  - Fix deparsing error with ON CONFLICT ... WHERE clauses

  - Fix tableoid errors for postgres_fdw

  - Prevent floating-point exceptions in pgbench

  - Make \det search Foreign Table names consistently

  - Fix quoting of domain constraint names in pg_dump

  - Prevent putting expanded objects into Const nodes

  - Allow compile of PL/Java on Windows

  - Fix 'unresolved symbol' errors in PL/Python execution

  - Allow Python2 and Python3 to be used in the same     database

  - Add support for Python 3.5 in PL/Python

  - Fix issue with subdirectory creation during initdb

  - Make pg_ctl report status correctly on Windows

  - Suppress confusing error when using pg_receivexlog with     older servers

  - Multiple documentation corrections and additions

  - Fix erroneous hash calculations in     gin_extract_jsonb_path()

  - For the full release notse, see:
    http://www.postgresql.org/docs/9.4/static/release-9-4-6.
    html

  - PL/Perl still needs to be linked with rpath, so that it     can find libperl.so at runtime. bsc#578053,     postgresql-plperl-keep-rpath.patch

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql94 fixes the following issues :

  - Security and bugfix release 9.4.6 :

  - *** IMPORTANT *** Users of version 9.4 will need to     reindex any jsonb_path_ops indexes they have created, in     order to fix a persistent issue with missing index     entries.

  - Fix infinite loops and buffer-overrun problems in     regular expressions (CVE-2016-0773, bsc#966436).

  - Fix regular-expression compiler to handle loops of     constraint arcs (CVE-2007-4772).

  - Prevent certain PL/Java parameters from being set by     non-superusers (CVE-2016-0766, bsc#966435).

  - Fix many issues in pg_dump with specific object types

  - Prevent over-eager pushdown of HAVING clauses for     GROUPING SETS

  - Fix deparsing error with ON CONFLICT ... WHERE clauses

  - Fix tableoid errors for postgres_fdw

  - Prevent floating-point exceptions in pgbench

  - Make \det search Foreign Table names consistently

  - Fix quoting of domain constraint names in pg_dump

  - Prevent putting expanded objects into Const nodes

  - Allow compile of PL/Java on Windows

  - Fix 'unresolved symbol' errors in PL/Python execution

  - Allow Python2 and Python3 to be used in the same     database

  - Add support for Python 3.5 in PL/Python

  - Fix issue with subdirectory creation during initdb

  - Make pg_ctl report status correctly on Windows

  - Suppress confusing error when using pg_receivexlog with     older servers

  - Multiple documentation corrections and additions

  - Fix erroneous hash calculations in     gin_extract_jsonb_path()

  - For the full release notse, see:
    http://www.postgresql.org/docs/9.4/static/release-9-4-6.
    html

  - PL/Perl still needs to be linked with rpath, so that it     can find libperl.so at runtime. bsc#578053,     postgresql-plperl-keep-rpath.patch

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql93 fixes the following issues :

  - Security and bugfix release 9.3.11 :

  - Fix infinite loops and buffer-overrun problems in     regular expressions (CVE-2016-0773, boo#966436).

  - Fix regular-expression compiler to handle loops of     constraint arcs (CVE-2007-4772).

  - Prevent certain PL/Java parameters from being set by     non-superusers (CVE-2016-0766, boo#966435).

  - Fix many issues in pg_dump with specific object types

  - Prevent over-eager pushdown of HAVING clauses for     GROUPING SETS

  - Fix deparsing error with ON CONFLICT ... WHERE clauses

  - Fix tableoid errors for postgres_fdw

  - Prevent floating-point exceptions in pgbench

  - Make \det search Foreign Table names consistently

  - Fix quoting of domain constraint names in pg_dump

  - Prevent putting expanded objects into Const nodes

  - Allow compile of PL/Java on Windows

  - Fix 'unresolved symbol' errors in PL/Python execution

  - Allow Python2 and Python3 to be used in the same     database

  - Add support for Python 3.5 in PL/Python

  - Fix issue with subdirectory creation during initdb

  - Make pg_ctl report status correctly on Windows

  - Suppress confusing error when using pg_receivexlog with     older servers

  - Multiple documentation corrections and additions

  - Fix erroneous hash calculations in     gin_extract_jsonb_path()

  - For the full release notse, see:
    http://www.postgresql.org/docs/9.3/static/release-9-3-11     .html

This update for postgresql93 fixes the following issues :

  - Security and bugfix release 9.3.11 :

  - Fix infinite loops and buffer-overrun problems in     regular expressions (CVE-2016-0773, bsc#966436).

  - Fix regular-expression compiler to handle loops of     constraint arcs (CVE-2007-4772).

  - Prevent certain PL/Java parameters from being set by     non-superusers (CVE-2016-0766, bsc#966435).

  - Fix many issues in pg_dump with specific object types

  - Prevent over-eager pushdown of HAVING clauses for     GROUPING SETS

  - Fix deparsing error with ON CONFLICT ... WHERE clauses

  - Fix tableoid errors for postgres_fdw

  - Prevent floating-point exceptions in pgbench

  - Make \det search Foreign Table names consistently

  - Fix quoting of domain constraint names in pg_dump

  - Prevent putting expanded objects into Const nodes

  - Allow compile of PL/Java on Windows

  - Fix 'unresolved symbol' errors in PL/Python execution

  - Allow Python2 and Python3 to be used in the same     database

  - Add support for Python 3.5 in PL/Python

  - Fix issue with subdirectory creation during initdb

  - Make pg_ctl report status correctly on Windows

  - Suppress confusing error when using pg_receivexlog with     older servers

  - Multiple documentation corrections and additions

  - Fix erroneous hash calculations in     gin_extract_jsonb_path()

  - For the full release notse, see:
    http://www.postgresql.org/docs/9.3/static/release-9-3-11     .html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL installed on the remote host is 9.1.x prior to 9.1.20, 9.2.x prior to 9.2.15, 9.3.x prior to 9.3.11, 9.4.x prior to 9.4.6, or 9.5.x prior to 9.5.1. It is, therefore, affected by the following vulnerabilities :

  - An integer overflow condition exists due to improper     validation of user-supplied input when handling regular     expressions. An authenticated, remote attacker can     exploit this, via a large Unicode character range in a     regular expression, to cause a denial of service     condition or the execution of arbitrary code.
    (CVE-2016-0773)

  - A privilege escalation vulnerability exists due to a     flaw in the init_custom_variable() function that is     triggered during the handling of PL/Java. An     authenticated, remote attacker can exploit this to gain     elevation privileges. (CVE-2016-0766)

PostgreSQL project reports :

Security Fixes for Regular Expressions, PL/Java

- CVE-2016-0773: This release closes security hole CVE-2016-0773, an issue with regular expression (regex) parsing. Prior code allowed users to pass in expressions which included out-of-range Unicode characters, triggering a backend crash. This issue is critical for PostgreSQL systems with untrusted users or which generate regexes based on user input.

- CVE-2016-0766: The update also fixes CVE-2016-0766, a privilege escalation issue for users of PL/Java. Certain custom configuration settings (GUCS) for PL/Java will now be modifiable only by the database superuser

Several vulnerabilities have been found in PostgreSQL-9.4, a SQL database system.

  - CVE-2016-0766     A privilege escalation vulnerability for users of     PL/Java was discovered. Certain custom configuration     settings (GUCs) for PL/Java will now be modifiable only     by the database superuser to mitigate this issue.

  - CVE-2016-0773     Tom Lane and Greg Stark discovered a flaw in the way     PostgreSQL processes specially crafted regular     expressions. Very large character ranges in bracket     expressions could cause infinite loops or memory     overwrites. A remote attacker can exploit this flaw to     cause a denial of service or, potentially, to execute     arbitrary code.

Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system.

  - CVE-2015-5288     Josh Kupershmidt discovered a vulnerability in the     crypt() function in the pgCrypto extension. Certain     invalid salt arguments can cause the server to crash or     to disclose a few bytes of server memory.

  - CVE-2016-0766     A privilege escalation vulnerability for users of     PL/Java was discovered. Certain custom configuration     settings (GUCs) for PL/Java will now be modifiable only     by the database superuser to mitigate this issue.

  - CVE-2016-0773     Tom Lane and Greg Stark discovered a flaw in the way     PostgreSQL processes specially crafted regular     expressions. Very large character ranges in bracket     expressions could cause infinite loops or memory     overwrites. A remote attacker can exploit this flaw to     cause a denial of service or, potentially, to execute     arbitrary code.

The remote Ubuntu 14.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-2894-1 advisory.

    It was discovered that PostgreSQL incorrectly handled certain regular expressions. A remote attacker could     possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service. (CVE-2016-0773)

    It was discovered that PostgreSQL incorrectly handled certain configuration settings (GUCS) for users of     PL/Java. A remote attacker could possibly use this issue to escalate privileges. (CVE-2016-0766)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
96474	GLSA-201701-33 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	high
9264	PostgreSQL 9.1 < 9.1.20 / 9.2 < 9.2.15 / 9.3 < 9.3.11 / 9.4 < 9.4.6 / 9.5 < 9.5.1 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
89730	SUSE SLED11 / SLES11 Security Update : postgresql94 (SUSE-SU-2016:0677-1)	Nessus	SuSE Local Security Checks	high
88980	openSUSE Security Update : postgresql94 (openSUSE-2016-271)	Nessus	SuSE Local Security Checks	high
88948	SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2016:0555-1)	Nessus	SuSE Local Security Checks	high
88926	openSUSE Security Update : postgresql93 (openSUSE-2016-253)	Nessus	SuSE Local Security Checks	high
88891	SUSE SLED12 / SLES12 Security Update : postgresql93 (SUSE-SU-2016:0539-1)	Nessus	SuSE Local Security Checks	high
88808	PostgreSQL 9.1.x < 9.1.20 / 9.2.x < 9.2.15 / 9.3.x < 9.3.11 / 9.4.x < 9.4.6 / 9.5.x < 9.5.1 Multiple Vulnerabilities	Nessus	Databases	high
88731	FreeBSD : PostgreSQL -- Security Fixes for Regular Expressions, PL/Java. (e8b6605b-d29f-11e5-8458-6cc21735f730)	Nessus	FreeBSD Local Security Checks	high
88727	Debian DSA-3476-1 : postgresql-9.4 - security update	Nessus	Debian Local Security Checks	high
88726	Debian DSA-3475-1 : postgresql-9.1 - security update	Nessus	Debian Local Security Checks	high
88712	Ubuntu 14.04 LTS : PostgreSQL vulnerabilities (USN-2894-1)	Nessus	Ubuntu Local Security Checks	high

Detections

Analytics

CVE-2016-0766

high

Tenable Plugins

high

high

high

high

high

high

high

high

high

high

high

high