Detections
Analytics

PostgreSQL < 9.1.3 / 9.0.7 / 8.4.11 Multiple Vulnerabilities

medium Nessus Network Monitor Plugin ID 6337

Synopsis

The remote database server is vulnerable to multiple attack vectors.

Description

Versions of PostgreSQL earlier than 9.1.3, 9.0.7, 8.4.11 and are potentially affected by the following vulnerabilities :

 - Permissions on a function called by a trigger are not properly checked. (CVE-2012-0866)

 - SSL certificate name checks are truncated to 32 characters, allowing connection spoofing under some circumstances when using third party certificates. (CVE-2012-0867)

 - Line breaks in object names can be exploited to execute arbitrary SQL when reloading a pg_dump file. (CVE-2012-0868)

Solution

Upgrade to PostgreSQL 8.4.11, 9.0.7, 9.1.3, or later.

See Also

http://www.postgresql.org/support/security

http://www.postgresql.org/about/news/1377

Plugin Details

Severity: Medium

ID: 6337

Family: Database

Published: 2/28/2012

Updated: 3/6/2019

Nessus ID: 63352, 63355

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Medium

Base Score: 6.5

Temporal Score: 4.8

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P

CVSS v3

Risk Factor: Medium

Base Score: 6.3

Temporal Score: 5.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:postgresql:postgresql

Patch Publication Date: 2/27/2012

Vulnerability Publication Date: 2/27/2012

Reference Information

CVE: CVE-2012-0866, CVE-2012-0867, CVE-2012-0868

BID: 52188