| Description: | Description:
The remote host is missing an update to postgresql
announced via advisory MDVSA-2010:103.
Multiple vulnerabilities was discovered and corrected in postgresql:
The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL
8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users
to cause a denial of service (daemon crash) or have unspecified
other impact via vectors involving a negative integer in the third
argument, as demonstrated by a SELECT statement that contains a
call to the substring function for a bit string, related to an
overflow. (CVE-2010-0442).
A flaw was found in the way the PostgreSQL server process
enforced permission checks on scripts written in PL/Perl. A remote,
authenticated user, running a specially-crafted PL/Perl script, could
use this flaw to bypass PL/Perl trusted mode restrictions, allowing
them to obtain sensitive information
execute arbitrary Perl scripts
or cause a denial of service (remove protected, sensitive data)
(CVE-2010-1169).
The PL/Tcl implementation in PostgreSQL 7.4 before 7.4.29, 8.0
before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before
8.3.11, 8.4 before 8.4.4, and 9.0 Beta before 9.0 Beta 2 loads
Tcl code from the pltcl_modules table regardless of the table's
ownership and permissions, which allows remote authenticated users,
with database-creation privileges, to execute arbitrary Tcl code by
creating this table and inserting a crafted Tcl script (CVE-2010-1170).
PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21,
8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not
properly check privileges during certain RESET ALL operations, which
allows remote authenticated users to remove arbitrary parameter
settings via a (1) ALTER USER or (2) ALTER DATABASE statement
(CVE-2010-1975).
Packages for 2008.0 and 2009.0 are provided as of the Extended
Maintenance Program.
Please visit this link to learn more:
http://store.mandriva.com/product_info.php?cPath=149&products_id=490
This update provides a solution to these vulnerabilities.
Affected: 2008.0, 2009.0, 2009.1, 2010.0, Corporate 4.0,
Enterprise Server 5.0
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
http://www.securityspace.com/smysecure/catid.html?in=MDVSA-2010:103
http://www.postgresql.org/support/security
Risk factor : Critical
CVSS Score:
8.5
|
