Test ID:	1.3.6.1.4.1.25623.1.0.840130
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-417-1)
Summary:	The remote host is missing an update for the 'postgresql-7.4, postgresql-8.0, postgresql-8.1' package(s) announced via the USN-417-1 advisory.
Description:	Summary: The remote host is missing an update for the 'postgresql-7.4, postgresql-8.0, postgresql-8.1' package(s) announced via the USN-417-1 advisory. Vulnerability Insight: Jeff Trout discovered that the PostgreSQL server did not sufficiently check data types of SQL function arguments in some cases. An authenticated attacker could exploit this to crash the database server or read out arbitrary locations in the server's memory, which could allow retrieving database content the attacker should not be able to see. (CVE-2007-0555) Jeff Trout reported that the query planner did not verify that a table was still compatible with a previously made query plan. By using ALTER COLUMN TYPE during query execution, an attacker could exploit this to read out arbitrary locations in the server's memory, which could allow retrieving database content the attacker should not be able to see. (CVE-2007-0556) Affected Software/OS: 'postgresql-7.4, postgresql-8.0, postgresql-8.1' package(s) on Ubuntu 5.10, Ubuntu 6.06, Ubuntu 6.10. Solution: Please install the updated package(s). CVSS Score: 8.5 CVSS Vector: AV:N/AC:L/Au:S/C:C/I:N/A:C
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2007-0555 BugTraq ID: 22387 http://www.securityfocus.com/bid/22387 Bugtraq: 20070206 rPSA-2007-0025-1 postgresql postgresql-server (Google Search) http://www.securityfocus.com/archive/1/459280/100/0/threaded Bugtraq: 20070208 rPSA-2007-0025-2 postgresql postgresql-server (Google Search) http://www.securityfocus.com/archive/1/459448/100/0/threaded Debian Security Information: DSA-1261 (Google Search) http://www.debian.org/security/2007/dsa-1261 http://fedoranews.org/cms/node/2554 http://security.gentoo.org/glsa/glsa-200703-15.xml http://www.mandriva.com/security/advisories?name=MDKSA-2007:037 http://lists.rpath.com/pipermail/security-announce/2007-February/000141.html http://osvdb.org/33087 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9739 http://www.redhat.com/support/errata/RHSA-2007-0064.html http://www.redhat.com/support/errata/RHSA-2007-0067.html http://www.redhat.com/support/errata/RHSA-2007-0068.html http://securitytracker.com/id?1017597 http://secunia.com/advisories/24028 http://secunia.com/advisories/24033 http://secunia.com/advisories/24042 http://secunia.com/advisories/24050 http://secunia.com/advisories/24057 http://secunia.com/advisories/24094 http://secunia.com/advisories/24151 http://secunia.com/advisories/24158 http://secunia.com/advisories/24284 http://secunia.com/advisories/24315 http://secunia.com/advisories/24513 http://secunia.com/advisories/24577 http://secunia.com/advisories/25220 SGI Security Advisory: 20070201-01-P ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc http://sunsolve.sun.com/search/document.do?assetkey=1-26-102825-1 SuSE Security Announcement: SUSE-SR:2007:010 (Google Search) http://www.novell.com/linux/security/advisories/2007_10_sr.html http://www.trustix.org/errata/2007/0007 https://usn.ubuntu.com/417-1/ http://www.ubuntu.com/usn/usn-417-2 http://www.vupen.com/english/advisories/2007/0478 http://www.vupen.com/english/advisories/2007/0774 XForce ISS Database: postgresql-sqlfunctions-info-disclosure(32195) https://exchange.xforce.ibmcloud.com/vulnerabilities/32195 Common Vulnerability Exposure (CVE) ID: CVE-2007-0556 http://osvdb.org/33302 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11353 XForce ISS Database: postgresql-datatype-information-disclosure(32191) https://exchange.xforce.ibmcloud.com/vulnerabilities/32191
Copyright	Copyright (C) 2009 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.