Mandrake Linux Security Advisory : postgresql (MDKSA-2005:040)

high Nessus Plugin ID 17139

Synopsis

The remote Mandrake Linux host is missing one or more security updates.

Description

A number of vulnerabilities were found and corrected in the PostgreSQL DBMS :

A flaw in the LOAD command could be abused by a local user to load arbitrary shared libraries and as a result execute arbitrary code with the privileges of the user running the postgresql server (CVE-2005-0227).

A permission checking flaw was found where a local user could bypass the EXECUTE permission check for functions using the CREATE AGGREGATE command (CVE-2005-0244).

Multiple buffer overflows were discovered in PL/PgSQL. A database user with permission to create plpgsql functions could trigger these flaws which could then lead to arbitrary code execution with the privileges of the user running the postgresql server (CVE-2005-0245 and CVE-2005-0247).

Finally, a flaw in the integer aggregator (intagg) contrib module was found. A user could create carefully crafted arrays and crash the server, causing a Denial of Service (CVE-2005-0246).

The updated packages have been patched to correct these problems.

Solution

Update the affected packages.

Plugin Details

Severity: High

ID: 17139

File Name: mandrake_MDKSA-2005-040.nasl

Version: 1.20

Type: local

Family: Mandriva Local Security Checks

Published: 2/18/2005

Updated: 1/6/2021

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.6

CVSS v2

Risk Factor: High

Base Score: 7.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

Vulnerability Information

CPE: p-cpe:/a:mandriva:linux:lib64ecpg3, p-cpe:/a:mandriva:linux:lib64ecpg3-devel, p-cpe:/a:mandriva:linux:lib64pgtcl2, p-cpe:/a:mandriva:linux:lib64pgtcl2-devel, p-cpe:/a:mandriva:linux:lib64pq3, p-cpe:/a:mandriva:linux:lib64pq3-devel, p-cpe:/a:mandriva:linux:libecpg3, p-cpe:/a:mandriva:linux:libecpg3-devel, p-cpe:/a:mandriva:linux:libpgtcl2, p-cpe:/a:mandriva:linux:libpgtcl2-devel, p-cpe:/a:mandriva:linux:libpq3, p-cpe:/a:mandriva:linux:libpq3-devel, p-cpe:/a:mandriva:linux:postgresql, p-cpe:/a:mandriva:linux:postgresql-contrib, p-cpe:/a:mandriva:linux:postgresql-devel, p-cpe:/a:mandriva:linux:postgresql-docs, p-cpe:/a:mandriva:linux:postgresql-jdbc, p-cpe:/a:mandriva:linux:postgresql-pl, p-cpe:/a:mandriva:linux:postgresql-server, p-cpe:/a:mandriva:linux:postgresql-tcl, p-cpe:/a:mandriva:linux:postgresql-test, cpe:/o:mandrakesoft:mandrake_linux:10.0, cpe:/o:mandrakesoft:mandrake_linux:10.1

Required KB Items: Host/local_checks_enabled, Host/cpu, Host/Mandrake/release, Host/Mandrake/rpm-list

Patch Publication Date: 2/17/2005

Reference Information

CVE: CVE-2005-0227, CVE-2005-0244, CVE-2005-0245, CVE-2005-0246, CVE-2005-0247

CWE: 119, 264, 94

MDKSA: 2005:040

Detections

Analytics