Detections
Analytics
PostgreSQL < 8.3.20 / 8.4.13 / 9.0.9 / 9.1.5 Multiple Vulnerabilities
medium Nessus Network Monitor Plugin ID 6815
Synopsis
The remote database server is affected by multiple vulnerabilities.Description
Versions of PostgreSQL earlier than 8.3.20 / 8.4.13 / 9.0.9 / 9.1.5 are potentially affected by multiple vulnerabilities. It therefore is affected by the following vulnerabilities :- A flaw in contrib/xml2's xslt_process can be used to read and write arbitrary files. (CVE-2012-3488)
- An xml_parse() DTD validation flaw can be used to read arbitrary files. (CVE-2012-3489)
Solution
Upgrade to PostgreSQL 8.3.20 / 8.4.13 / 9.0.9 / 9.1.5 or later.See Also
http://www.postgresql.org/about/news/1407
http://www.postgresql.org/docs/8.3/static/release-8-3-20.html
http://www.postgresql.org/docs/8.4/static/release-8-4-13.html
http://www.postgresql.org/docs/9.0/static/release-9-0-9.html
http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
Plugin Details
Severity: Medium
ID: 6815
Family: Database
Published: 5/14/2013
Updated: 3/6/2019
Nessus ID: 63354
Risk Information
VPR
Risk Factor: Medium
Score: 6.5
CVSS v2
Risk Factor: Medium
Base Score: 5.8
Temporal Score: 4.3
Vector: CVSS2#AV:N/AC:M/Au:N/C:P/I:P/A:N
CVSS v3
Risk Factor: Medium
Base Score: 4.8
Temporal Score: 4.2
Vector: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:postgresql:postgresql
Patch Publication Date: 8/17/2012
Vulnerability Publication Date: 8/17/2012
Reference Information
CVE: CVE-2012-3488, CVE-2012-3489