PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite the entire contents of the object, resulting in a denial of service.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2678 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql94-postgresql     (9.4.14). (BZ#1484635, BZ#1484638, BZ#1484644)

    Security Fix(es):

    * It was found that authenticating to a PostgreSQL database account with an empty password was possible     despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to     gain access to database accounts with empty passwords. (CVE-2017-7546)

    * An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on     foreign servers. A remote, authenticated attacker could potentially use this flaw to retrieve passwords     from the user mappings defined by the foreign server owners without actually having the privileges to do     so. (CVE-2017-7547)

    * An authorization flaw was found in the way PostgreSQL handled large objects. A remote, authenticated     attacker with no privileges on a large object could potentially use this flaw to overwrite the entire     content of the object, thus resulting in denial of service. (CVE-2017-7548)

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Ben     de Graaff, Jelte Fennema, and Jeroen van der Ham as the original reporters of CVE-2017-7546; Jeff Janes as     the original reporter of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2017:2677 advisory.

    PostgreSQL is an advanced object-relational database management system (DBMS).

    The following packages have been upgraded to a later upstream version: rh-postgresql95-postgresql (9.5.9).
    (BZ#1484637, BZ#1484642, BZ#1484648)

    Security Fix(es):

    * It was found that authenticating to a PostgreSQL database account with an empty password was possible     despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to     gain access to database accounts with empty passwords. (CVE-2017-7546)

    * An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on     foreign servers. A remote, authenticated attacker could potentially use this flaw to retrieve passwords     from the user mappings defined by the foreign server owners without actually having the privileges to do     so. (CVE-2017-7547)

    * An authorization flaw was found in the way PostgreSQL handled large objects. A remote, authenticated     attacker with no privileges on a large object could potentially use this flaw to overwrite the entire     content of the object, thus resulting in denial of service. (CVE-2017-7548)

    Red Hat would like to thank the PostgreSQL project for reporting these issues. Upstream acknowledges Ben     de Graaff, Jelte Fennema, and Jeroen van der Ham as the original reporters of CVE-2017-7546; Jeff Janes as     the original reporter of CVE-2017-7547; and Chapman Flack as the original reporter of CVE-2017-7548.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

This update for postgresql95 fixes the following issues :

Upate to PostgreSQL 9.5.11 :

Security issues fixed :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-11.html 

  - CVE-2018-1053, boo#1077983: Ensure that all temporary     files made by pg_upgrade are non-world-readable. 

  - boo#1079757: Rename pg_rewind's copy_file_range function     to avoid conflict with new Linux system call of that     name.

In version 9.5.10 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-10.html

  - CVE-2017-15098, boo#1067844: Memory disclosure in JSON     functions.

  - CVE-2017-15099, boo#1067841: INSERT ... ON CONFLICT DO     UPDATE fails to enforce SELECT privileges.

In version 9.5.9 :

  - https://www.postgresql.org/docs/9.5/static/release-9-5-9.html

  - Show foreign tables in     information_schema.table_privileges view.

  - Clean up handling of a fatal exit (e.g., due to receipt     of SIGTERM) that occurs while trying to execute a     ROLLBACK of a failed transaction.

  - Remove assertion that could trigger during a fatal exit.

  - Correctly identify columns that are of a range type or     domain type over a composite type or domain type being     searched for.

  - Fix crash in pg_restore when using parallel mode and     using a list file to select a subset of items to     restore.

  - Change ecpg's parser to allow RETURNING clauses without     attached C variables.

In version 9.5.8

  - https://www.postgresql.org/docs/9.5/static/release-9-5-8.html

  - CVE-2017-7547, boo#1051685: Further restrict visibility     of pg_user_mappings.umoptions, to protect passwords     stored as user mapping options.

  - CVE-2017-7546, boo#1051684: Disallow empty passwords in     all password-based authentication methods.

  - CVE-2017-7548, boo#1053259: lo_put() function ignores     ACLs.

The remote host is affected by the vulnerability described in GLSA-201710-06 (PostgreSQL: Multiple vulnerabilities)

    Multiple vulnerabilities have been discovered in PostgreSQL. Please       review the referenced CVE identifiers for details.
  Impact :

    A remote attacker could escalate privileges, cause a Denial of Service       condition, obtain passwords, cause a loss in information, or obtain       sensitive information.
  Workaround :

    There is no known workaround at this time.

This update for postgresql96 fixes the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

The changelog for this release is here:
&#9;https://www.postgresql.org/docs/9.6/static/release-9-6-4.html

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql94 fixes the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

This update was imported from the SUSE:SLE-12:Update update project.

This update for postgresql96 fixes the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259) The changelog for this release is here:
    https://www.postgresql.org/docs/9.6/static/release-9-6-4     .html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for postgresql94 fixes the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

pg_user_mappings view discloses passwords to users lacking server privileges :

An authorization flaw was found in the way PostgreSQL handled access to the pg_user_mappings view on foreign servers. A remote authenticated attacker could potentially use this flaw to retrieve passwords from the user mappings defined by the foreign server owners without actually having the privileges to do so. (CVE-2017-7547)

Empty password accepted in some authentication methods :

It was found that authenticating to a PostgreSQL database account with an empty password was possible despite libpq's refusal to send an empty password. A remote attacker could potentially use this flaw to gain access to database accounts with empty passwords. (CVE-2017-7546)

lo_put() function ignores ACLs :

An authorization flaw was found in the way PostgreSQL handled large objects. A remote authenticated attacker with no privileges on a large object could potentially use this flaw to overwrite the entire content of the object, thus resulting in denial of service. (CVE-2017-7548)

Postgresql93 was updated to 9.3.18 to fix the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259)

The changelog for the release is here :

&#9;https://www.postgresql.org/docs/9.3/static/release-9-3-18.html

This update was imported from the SUSE:SLE-12:Update update project.

rebase: update to 9.5.8, security fix for CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 Per release notes:
http://www.postgresql.org/docs/9.5/static/release-9-5-8.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Postgresql94 was updated to 9.4.13 to fix the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259) The changelog for this release is here:
    https://www.postgresql.org/docs/9.4/static/release-9-4-1     3.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Postgresql93 was updated to 9.3.18 to fix the following issues :

  - CVE-2017-7547: Further restrict visibility of     pg_user_mappings.umoptions, to protect passwords stored     as user mapping options. (bsc#1051685)

  - CVE-2017-7546: Disallow empty passwords in all     password-based authentication methods. (bsc#1051684)

  - CVE-2017-7548: lo_put() function ignores ACLs.
    (bsc#1053259) The changelog for the release is here:
    &#9;https://www.postgresql.org/docs/9.3/static/release-9
    -3-18.html

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

The version of PostgreSQL installed on the remote host is 9.2.x prior to 9.2.22, 9.3.x prior to 9.3.18, 9.4.x prior to 9.4.13, 9.5.x prior to 9.5.8, or 9.6.x prior to 9.6.4. It is, therefore, affected by multiple vulnerabilities :

  - An authentication bypass flaw exists in that an empty password is     accepted in some authentication methods. (CVE-2017-7546)

  - An information disclosure vulnerability exists in the     'pg_user_mappings' catalog view that can disclose passwords to     users lacking server privileges. (CVE-2017-7547)

    Note: The 'pg_user_mappings' update will only fix the behavior in     newly created clusters utilizing initdb. To fix this issue on     existing systems you will need to follow the steps in the release     notes.

  - A flaw exists in the lo_put() function due to improper checking of     permissions that leads to ignoring of ACLs. (CVE-2017-7548)

The remote Ubuntu 14.04 LTS / 16.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-3390-1 advisory.

    Ben de Graaff, Jelte Fennema, and Jeroen van der Ham discovered that PostgreSQL allowed the use of empty     passwords in some authentication methods, contrary to expected behaviour. A remote attacker could use an     empty password to authenticate to servers that were believed to have password login disabled.
    (CVE-2017-7546)

    Jeff Janes discovered that PostgreSQL incorrectly handled the pg_user_mappings catalog view. A remote     attacker without server privileges could possibly use this issue to obtain certain passwords.
    (CVE-2017-7547)

    Chapman Flack discovered that PostgreSQL incorrectly handled lo_put() permissions. A remote attacker could     possibly use this issue to change the data in a large object. (CVE-2017-7548)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

rebase: update to 9.6.4, security fix for CVE-2017-7546 CVE-2017-7547 CVE-2017-7548 

Per release notes:
https://www.postgresql.org/docs/9.6/static/release-9-6-4.html

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Several vulnerabilities have been found in the PostgreSQL database system :

  - CVE-2017-7546     In some authentication methods empty passwords were     accepted.

  - CVE-2017-7547     User mappings could leak data to unprivileged users.

  - CVE-2017-7548     The lo_put() function ignored ACLs.

  For more in-depth descriptions of the security vulnerabilities,   please see https://www.postgresql.org/about/news/1772/

The PostgreSQL project reports :

- CVE-2017-7546: Empty password accepted in some authentication methods

- CVE-2017-7547: The 'pg_user_mappings' catalog view discloses passwords to users lacking server privileges

- CVE-2017-7548: lo_put() function ignores ACLs

ID	Name	Product	Family	Severity
210315	RHEL 6 / 7 : rh-postgresql94-postgresql (RHSA-2017:2678)	Nessus	Red Hat Local Security Checks	critical
210267	RHEL 6 / 7 : rh-postgresql95-postgresql (RHSA-2017:2677)	Nessus	Red Hat Local Security Checks	critical
106965	openSUSE Security Update : postgresql95 (openSUSE-2018-204)	Nessus	SuSE Local Security Checks	critical
103724	GLSA-201710-06 : PostgreSQL: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	critical
103157	openSUSE Security Update : postgresql96 (openSUSE-2017-1021)	Nessus	SuSE Local Security Checks	critical
103156	openSUSE Security Update : postgresql94 (openSUSE-2017-1020)	Nessus	SuSE Local Security Checks	critical
102974	SUSE SLED12 / SLES12 Security Update : postgresql96 (SUSE-SU-2017:2356-1)	Nessus	SuSE Local Security Checks	critical
102973	SUSE SLED12 / SLES12 Security Update : postgresql94 (SUSE-SU-2017:2355-1)	Nessus	SuSE Local Security Checks	critical
102873	Amazon Linux AMI : postgresql94 / postgresql95 (ALAS-2017-885)	Nessus	Amazon Linux Local Security Checks	critical
102847	openSUSE Security Update : postgresql93 (openSUSE-2017-985)	Nessus	SuSE Local Security Checks	critical
102828	Fedora 25 : postgresql (2017-9148fe36b9)	Nessus	Fedora Local Security Checks	critical
102800	SUSE SLES11 Security Update : postgresql94 (SUSE-SU-2017:2258-1)	Nessus	SuSE Local Security Checks	critical
102695	SUSE SLES12 Security Update : postgresql93 (SUSE-SU-2017:2236-1)	Nessus	SuSE Local Security Checks	critical
102527	PostgreSQL 9.2.x < 9.2.22 / 9.3.x < 9.3.18 / 9.4.x < 9.4.13 / 9.5.x < 9.5.8 / 9.6.x < 9.6.4 Multiple Vulnerabilities	Nessus	Databases	critical
102522	Ubuntu 14.04 LTS / 16.04 LTS : PostgreSQL vulnerabilities (USN-3390-1)	Nessus	Ubuntu Local Security Checks	critical
102490	Fedora 26 : postgresql (2017-d9cac37bd8)	Nessus	Fedora Local Security Checks	critical
102443	Debian DSA-3936-1 : postgresql-9.6 - security update	Nessus	Debian Local Security Checks	critical
102442	Debian DSA-3935-1 : postgresql-9.4 - security update	Nessus	Debian Local Security Checks	critical
102408	FreeBSD : PostgreSQL vulnerabilities (982872f1-7dd3-11e7-9736-6cc21735f730)	Nessus	FreeBSD Local Security Checks	critical

Detections

Analytics

CVE-2017-7548

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical