Ubuntu Local Security Checks : Ubuntu 4.10 USN-71-1 (postgresql)

Price/Feature Summary | Order | New Vulnerabilities | Confidentiality | Vulnerability Search

Vulnerability Search		Search 61204 CVE descriptions and 32582 test descriptions, access 10,000+ cross references.
	Tests CVE All

Test ID: 1.3.6.1.4.1.25623.1.0.51282

Category: Ubuntu Local Security Checks

Title: Ubuntu 4.10 USN-71-1 (postgresql)

Summary: Ubuntu 4.10 USN-71-1 (postgresql)

Description:
The remote host is missing an update to postgresql
announced via advisory USN-71-1.

John Heasman discovered a local privilege escalation in the PostgreSQL
server. Any user could use the LOAD extension to load any shared
library into the PostgreSQL server
the library's initialisation
function was then executed with the permissions of the server.

Now the use of LOAD is restricted to the database superuser (usually
'postgres').

Note: Since there is no way for normal database users to create
arbitrary files, this vulnerability is not exploitable remotely, e. g.
by uploading a shared library in the form of a Binary Large Object
(BLOB) to a public web server.

The following packages are affected: postgresql

Solution:
The problem can be corrected by upgrading the affected package to
version 7.4.5-3ubuntu0.2. In general, a standard system upgrade is
sufficient to effect the necessary changes.

http://www.ubuntulinux.org/support/documentation/usn/usn-71-1
http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php

Risk factor : High

Copyright Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com

This is only one of 32582 vulnerability tests in our test suite. Find out more about running a complete security audit.
To run a free test of this vulnerability against your system, register below.

New User Registration
Email:

UserID:

Passwd:

Please email me your monthly newsletters, informing the latest services, improvements & surveys.

Please email me a vulnerability test announcement whenever a new test is added.

Privacy

Registered User Login

UserID:

Passwd:

Forgot userid or passwd?

Email/Userid:

Test ID:	1.3.6.1.4.1.25623.1.0.51282
Category:	Ubuntu Local Security Checks
Title:	Ubuntu 4.10 USN-71-1 (postgresql)
Summary:	Ubuntu 4.10 USN-71-1 (postgresql)
Description:	The remote host is missing an update to postgresql announced via advisory USN-71-1. John Heasman discovered a local privilege escalation in the PostgreSQL server. Any user could use the LOAD extension to load any shared library into the PostgreSQL server the library's initialisation function was then executed with the permissions of the server. Now the use of LOAD is restricted to the database superuser (usually 'postgres'). Note: Since there is no way for normal database users to create arbitrary files, this vulnerability is not exploitable remotely, e. g. by uploading a shared library in the form of a Binary Large Object (BLOB) to a public web server. The following packages are affected: postgresql Solution: The problem can be corrected by upgrading the affected package to version 7.4.5-3ubuntu0.2. In general, a standard system upgrade is sufficient to effect the necessary changes. http://www.ubuntulinux.org/support/documentation/usn/usn-71-1 http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php Risk factor : High
Copyright	Copyright (c) 2005 E-Soft Inc. http://www.securityspace.com