SunOS 5.10_x86：PostgreSQL 8.2 核心修补程序。Sun 上次更新此修补程序的日期：2011 年 6 月 9 日

SunOS 5.10_x86：PostgreSQL 8.3 核心修补程序。Sun 上次更新此修补程序的日期：2013 年 3 月 29 日

SunOS 5.10_x86: PostgreSQL patch.
Date this patch was last updated by Sun : Jan/14/10

SunOS 5.10_x86: PostgreSQL 8.2 core patch.
Date this patch was last updated by Sun : Jun/09/11

SunOS 5.10_x86: PostgreSQL 8.3 core patch.
Date this patch was last updated by Sun : Mar/29/13

From Red Hat Security Advisory 2009:1485 :

Updated postgresql packages that fix a security issue are now available for Red Hat Enterprise Linux 3.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0039 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)

All PostgreSQL users should upgrade to these updated packages, which contain a backported patch to correct this issue. If you are running a PostgreSQL server, the postgresql service must be restarted for this update to take effect.

Updated postgresql packages that fix two security issues are now available for Red Hat Enterprise Linux 4 and 5.

This update has been rated as having moderate security impact by the Red Hat Security Response Team.

PostgreSQL is an advanced object-relational database management system (DBMS).

It was discovered that the upstream patch for CVE-2007-6600 included in the Red Hat Security Advisory RHSA-2008:0038 did not include protection against misuse of the RESET ROLE and RESET SESSION AUTHORIZATION commands. An authenticated user could use this flaw to install malicious code that would later execute with superuser privileges. (CVE-2009-3230)

A flaw was found in the way PostgreSQL handled encoding conversion. A remote, authenticated user could trigger an encoding conversion failure, possibly leading to a temporary denial of service. Note: To exploit this issue, a locale and client encoding for which specific messages fail to translate must be selected (the availability of these is determined by an administrator-defined locale setting).
(CVE-2009-0922)

Note: For Red Hat Enterprise Linux 4, this update upgrades PostgreSQL to version 7.4.26. For Red Hat Enterprise Linux 5, this update upgrades PostgreSQL to version 8.1.18. Refer to the PostgreSQL Release Notes for a list of changes :

http://www.postgresql.org/docs/7.4/static/release.html http://www.postgresql.org/docs/8.1/static/release.html

All PostgreSQL users should upgrade to these updated packages, which resolve these issues. If the postgresql service is running, it will be automatically restarted after installing this update.

Multiple security vulnerabilities have been fixed in PostgrSQL

  - allows remote authenticated users to cause a denial of     service. (CVE-2009-3229)

  - allows remote authenticated users to gain higher     privileges. (CVE-2009-3230)

  - when using LDAP authentication with anonymous binds,     allows remote attackers to bypass authentication via an     empty password. (CVE-2009-3231)

Multiple security vulnerabilities have been fixed in PostgrSQL

  - CVE-2009-3229: allows remote authenticated users to     cause a denial of service

  - CVE-2009-3230: allows remote authenticated users to gain     higher privileges

  - CVE-2009-3231: when using LDAP authentication with     anonymous binds, allows remote attackers to bypass     authentication via an empty password

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to cause a denial of service (backend shutdown) by re-LOAD-ing libraries from a certain plugins directory (CVE-2009-3229).

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600 (CVE-2009-3230).

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password (CVE-2009-3231).

This update provides a fix for this vulnerability.

The remote host is running PostgreSQL, a database application. The version of PostgreSQL is potentially affected by multiple issues : 

  - Authenticated non-superusers can shut down the backend server by re-LOAD-ing libraries in $libdir/plugins, if any libraries are present there.

  - A privilege escalation issue allows some actions to be performed with superuser privileges instead of table owner privileges.  This is related to the fix for CVE-2007-6600 which failed to include protection against misuse of 'RESET SESSION AUTHORIZATION'.

  - If PostgreSQL is configured with LDAP authentication, and your LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password.

ID	Name	Product	Family	Published	Updated	Severity
107978	Solaris 10 (x86)：136999-10	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
108005	Solaris 10 (x86)：138827-12	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
107893	Solaris 10 (x86) : 123591-12	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
107978	Solaris 10 (x86) : 136999-10	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
108005	Solaris 10 (x86) : 138827-12	Nessus	Solaris Local Security Checks	3/12/2018	1/14/2021	medium
67937	Oracle Linux 3 : postgresql (ELSA-2009-1485)	Nessus	Oracle Linux Local Security Checks	7/12/2013	1/14/2021	medium
43800	CentOS 4 / 5 : postgresql (CESA-2009:1484)	Nessus	CentOS Local Security Checks	1/6/2010	1/4/2021	medium
41643	SuSE 10 Security Update : PostgreSQL (ZYPP Patch Number 6500)	Nessus	SuSE Local Security Checks	9/28/2009	1/14/2021	medium
41938	openSUSE Security Update : postgresql (postgresql-1322)	Nessus	SuSE Local Security Checks	9/29/2009	1/14/2021	medium
41949	MDVSA-2009:177 : postgresql	Nessus	Mandriva Local Security Checks	10/1/2009	1/6/2021	medium
5170	PostgreSQL Multiple Vulnerabilities	Nessus Network Monitor	Database	9/14/2009	3/6/2019	medium

Detections

Analytics

Plugins Search

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium

medium