ID de Prueba:	1.3.6.1.4.1.25623.1.0.63974
Categoría:	Red Hat Local Security Checks
Título:	RedHat Security Advisory RHSA-2009:0479
Resumen:	The remote host is missing updates announced in;advisory RHSA-2009:0479.;;Perl DBI is a database access Application Programming Interface (API) for;the Perl language. perl-DBD-Pg allows Perl applications to access;PostgreSQL database servers.;;A heap-based buffer overflow flaw was discovered in the pg_getline function;implementation. If the pg_getline or getline functions read large,;untrusted records from a database, it could cause an application using;these functions to crash or, possibly, execute arbitrary code.;(CVE-2009-0663);;Note: After installing this update, pg_getline may return more data than;specified by its second argument, as this argument will be ignored. This is;consistent with current upstream behavior. Previously, the length limit;(the second argument) was not enforced, allowing a buffer overflow.;;A memory leak flaw was found in the function performing the de-quoting of;BYTEA type values acquired from a database. An attacker able to cause an;application using perl-DBD-Pg to perform a large number of SQL queries;returning BYTEA records, could cause the application to use excessive;amounts of memory or, possibly, crash. (CVE-2009-1341);;All users of perl-DBD-Pg are advised to upgrade to this updated package,;which contains backported patches to fix these issues. Applications using;perl-DBD-Pg must be restarted for the update to take effect.
Descripción:	Summary: The remote host is missing updates announced in advisory RHSA-2009:0479. Perl DBI is a database access Application Programming Interface (API) for the Perl language. perl-DBD-Pg allows Perl applications to access PostgreSQL database servers. A heap-based buffer overflow flaw was discovered in the pg_getline function implementation. If the pg_getline or getline functions read large, untrusted records from a database, it could cause an application using these functions to crash or, possibly, execute arbitrary code. (CVE-2009-0663) Note: After installing this update, pg_getline may return more data than specified by its second argument, as this argument will be ignored. This is consistent with current upstream behavior. Previously, the length limit (the second argument) was not enforced, allowing a buffer overflow. A memory leak flaw was found in the function performing the de-quoting of BYTEA type values acquired from a database. An attacker able to cause an application using perl-DBD-Pg to perform a large number of SQL queries returning BYTEA records, could cause the application to use excessive amounts of memory or, possibly, crash. (CVE-2009-1341) All users of perl-DBD-Pg are advised to upgrade to this updated package, which contains backported patches to fix these issues. Applications using perl-DBD-Pg must be restarted for the update to take effect. Solution: Please note that this update is available via Red Hat Network. To use Red Hat Network, launch the Red Hat Update Agent with the following command: up2date CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Referencia Cruzada:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0663 BugTraq ID: 34755 http://www.securityfocus.com/bid/34755 Debian Security Information: DSA-1780 (Google Search) http://www.debian.org/security/2009/dsa-1780 https://launchpad.net/bugs/cve/2009-0663 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9499 http://www.redhat.com/support/errata/RHSA-2009-0479.html http://www.redhat.com/support/errata/RHSA-2009-1067.html http://secunia.com/advisories/34909 http://secunia.com/advisories/35058 http://secunia.com/advisories/35685 SuSE Security Announcement: SUSE-SR:2009:012 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html XForce ISS Database: libdbdpgperl-unspecified-bo(50467) https://exchange.xforce.ibmcloud.com/vulnerabilities/50467 Common Vulnerability Exposure (CVE) ID: CVE-2009-1341 BugTraq ID: 34757 http://www.securityfocus.com/bid/34757 https://launchpad.net/bugs/cve/2009-1341 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9680 XForce ISS Database: libdbdpgperl-dequotebytea-dos(50387) https://exchange.xforce.ibmcloud.com/vulnerabilities/50387
Copyright	Copyright (C) 2009 E-Soft Inc.

Esta es sólo una de 145615 pruebas de vulnerabilidad en nuestra serie de pruebas. Encuentre más sobre cómo ejecutar una auditoría de seguridad completa. Para ejecutar una prueba gratuita de esta vulnerabilidad contra su sistema, regístrese ahora.