Detections
Analytics
openSUSE Security Update : postgresql91 (openSUSE-SU-2013:0627-1)
high Nessus Plugin ID 74963
Language:
Synopsis
The remote openSUSE host is missing a security update.Description
postgresql was updated to version 9.1.9 (bnc#812525) :- CVE-2013-1899: Fix insecure parsing of server command-line switches. A connection request containing a database name that begins with '-' could be crafted to damage or destroy files within the server's data directory, even if the request is eventually rejected.
- CVE-2013-1900: Reset OpenSSL randomness state in each postmaster child process. This avoids a scenario wherein random numbers generated by 'contrib/pgcrypto' functions might be relatively easy for another database user to guess. The risk is only significant when the postmaster is configured with ssl = on but most connections don't use SSL encryption.
- CVE-2013-1901: Make REPLICATION privilege checks test current user not authenticated user. An unprivileged database user could exploit this mistake to call pg_start_backup() or pg_stop_backup(), thus possibly interfering with creation of routine backups.
- See the release notes for the rest of the changes:
http://www.postgresql.org/docs/9.1/static/release-9-1-9.
html /usr/share/doc/packages/postgresql91/HISTORY
Solution
Update the affected postgresql91 packages.See Also
https://www.postgresql.org/docs/9.1/release-9-1-9.html
https://bugzilla.novell.com/show_bug.cgi?id=812525
https://lists.opensuse.org/opensuse-updates/2013-04/msg00044.html
Plugin Details
Severity: High
ID: 74963
File Name: openSUSE-2013-307.nasl
Version: 1.6
Type: local
Agent: unix
Family: SuSE Local Security Checks
Published: 6/13/2014
Updated: 1/19/2021
Supported Sensors: Continuous Assessment, Frictionless Assessment Agent, Frictionless Assessment AWS, Frictionless Assessment Azure, Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: High
Base Score: 8.5
Vector: CVSS2#AV:N/AC:M/Au:S/C:C/I:C/A:C
Vulnerability Information
CPE: p-cpe:/a:novell:opensuse:libecpg6, p-cpe:/a:novell:opensuse:postgresql91-devel-debuginfo, p-cpe:/a:novell:opensuse:postgresql91-devel-32bit, p-cpe:/a:novell:opensuse:libpq5-debuginfo, p-cpe:/a:novell:opensuse:postgresql91-plpython, p-cpe:/a:novell:opensuse:postgresql91-contrib-debuginfo, cpe:/o:novell:opensuse:12.1, p-cpe:/a:novell:opensuse:libpq5, p-cpe:/a:novell:opensuse:libpq5-debuginfo-32bit, p-cpe:/a:novell:opensuse:postgresql91-plpython-debuginfo, p-cpe:/a:novell:opensuse:postgresql91-devel-debuginfo-32bit, p-cpe:/a:novell:opensuse:libecpg6-32bit, p-cpe:/a:novell:opensuse:postgresql91, p-cpe:/a:novell:opensuse:postgresql91-devel, p-cpe:/a:novell:opensuse:postgresql91-pltcl-debuginfo, p-cpe:/a:novell:opensuse:postgresql91-contrib, p-cpe:/a:novell:opensuse:postgresql91-server-debuginfo, p-cpe:/a:novell:opensuse:postgresql91-libs-debugsource, p-cpe:/a:novell:opensuse:postgresql91-pltcl, p-cpe:/a:novell:opensuse:postgresql91-server, p-cpe:/a:novell:opensuse:postgresql91-debugsource, p-cpe:/a:novell:opensuse:libecpg6-debuginfo-32bit, p-cpe:/a:novell:opensuse:postgresql91-plperl-debuginfo, cpe:/o:novell:opensuse:12.2, p-cpe:/a:novell:opensuse:postgresql91-debuginfo, p-cpe:/a:novell:opensuse:libpq5-32bit, p-cpe:/a:novell:opensuse:postgresql91-plperl, p-cpe:/a:novell:opensuse:libecpg6-debuginfo
Required KB Items: Host/local_checks_enabled, Host/SuSE/release, Host/SuSE/rpm-list, Host/cpu
Patch Publication Date: 4/4/2013