CVE ID:	CVE-2014-0060
Description:	PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
Test IDs:	1.3.6.1.4.1.25623.1.0.881888   1.3.6.1.4.1.25623.1.0.881894   1.3.6.1.4.1.25623.1.0.881889   1.3.6.1.4.1.25623.1.0.871136   1.3.6.1.4.1.25623.1.0.702865   1.3.6.1.4.1.25623.1.0.702864   1.3.6.1.4.1.25623.1.0.871130
Cross References:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0060 61307 http://secunia.com/advisories/61307 APPLE-SA-2014-10-16-3 http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html DSA-2864 http://www.debian.org/security/2014/dsa-2864 DSA-2865 http://www.debian.org/security/2014/dsa-2865 RHSA-2014:0211 http://rhn.redhat.com/errata/RHSA-2014-0211.html RHSA-2014:0221 http://rhn.redhat.com/errata/RHSA-2014-0221.html RHSA-2014:0249 http://rhn.redhat.com/errata/RHSA-2014-0249.html RHSA-2014:0469 http://rhn.redhat.com/errata/RHSA-2014-0469.html USN-2120-1 http://www.ubuntu.com/usn/USN-2120-1 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://support.apple.com/kb/HT6448 http://support.apple.com/kb/HT6448 http://wiki.postgresql.org/wiki/20140220securityrelease http://wiki.postgresql.org/wiki/20140220securityrelease http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.postgresql.org/about/news/1506/ http://www.postgresql.org/about/news/1506/ https://puppet.com/security/cve/cve-2014-0060 https://puppet.com/security/cve/cve-2014-0060 https://support.apple.com/kb/HT6536 https://support.apple.com/kb/HT6536 openSUSE-SU-2014:0345 http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html openSUSE-SU-2014:0368 http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html