The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass intended access restrictions and consequently obtain sensitive server memory information or cause a denial of service (server crash) via a crafted bytea value in a BRIN index page.

The version of PostgreSQL installed on the remote host is 9.1.x prior to 9.1.20, 9.2.x prior to 9.2.15, 9.3.x prior to 9.3.11, or 9.4.x prior to 9.4.6, or 9.5.x prior to 9.5.1 and is affected by multiple vulnerabilities :

 - An integer overflow condition exists that is triggered as user-supplied input is not properly validated when handling regular expressions. This may allow an attacker to cause a heap-based buffer overflow, resulting in a denial of service or potentially allowing the execution of arbitrary code.
 - A flaw exists in the 'init_custom_variable()' function in 'backend/utils/misc/guc.c' that is triggered during the handling of PL/Java. This may allow an attacker to gain elevated privileges.
 - A flaw exists related to certain security definer functions or when a common user and query is planned initially and reused across multiple SET ROLEs. This may allow an authenticated attacker to cause incorrect policies to be applied in cases where role-specific polices are used.
 - A flaw exists in 'contrib/pageinspect/brinfuncs.c' that is triggered during the use of pageinspect functions on BRIN index pages. This may allow an authenticated attacker to cause a crash or gain access to a small amount of server memory information, which may potentially contain credential information.

The version of PostgreSQL installed on the remote host is 9.5.x prior to 9.5.2. It is, therefore, affected by multiple vulnerabilities :

  - A flaw exists that is triggered when a query plan is     incorrectly reused for more than one ROLE within the     same session. An authenticated, remote attacker can     exploit this to cause an incorrect set of Row Level     Security (RLS) policies to be used for the query.
    (CVE-2016-2193)   
  - A denial of service vulnerability exists within file     contrib/pageinspect/brinfuncs.c when certain functions     in the pageinspect extension are used with BRIN index     pages. An authenticated, remote attacker can exploit     this, via contrived 'bytea' values, to crash the server     or disclose a small amount of server memory.
    (CVE-2016-3065)

PostgreSQL project reports :

Security Fixes for RLS, BRIN

This release closes security hole CVE-2016-2193 (https://access.redhat.com/security/cve/CVE-2016-2193), where a query plan might get reused for more than one ROLE in the same session. This could cause the wrong set of Row Level Security (RLS) policies to be used for the query.

The update also fixes CVE-2016-3065 (https://access.redhat.com/security/cve/CVE-2016-3065), a server crash bug triggered by using `pageinspect` with BRIN index pages. Since an attacker might be able to expose a few bytes of server memory, this crash is being treated as a security issue.

ID	Name	Product	Family	Severity
9264	PostgreSQL 9.1 < 9.1.20 / 9.2 < 9.2.15 / 9.3 < 9.3.11 / 9.4 < 9.4.6 / 9.5 < 9.5.1 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
90423	PostgreSQL 9.5.x < 9.5.2 Multiple Vulnerabilities	Nessus	Databases	critical
90290	FreeBSD : PostgreSQL -- minor security problems. (97a24d2e-f74c-11e5-8458-6cc21735f730)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2016-3065

critical

Tenable Plugins

high

critical

critical