Test ID:	1.3.6.1.4.1.25623.1.0.841727
Category:	Ubuntu Local Security Checks
Title:	Ubuntu: Security Advisory (USN-2120-1)
Summary:	The remote host is missing an update for the 'postgresql-8.4, postgresql-9.1' package(s) announced via the USN-2120-1 advisory.
Description:	Summary: The remote host is missing an update for the 'postgresql-8.4, postgresql-9.1' package(s) announced via the USN-2120-1 advisory. Vulnerability Insight: Noah Misch and Jonas Sundman discovered that PostgreSQL did not correctly enforce ADMIN OPTION restrictions. An authenticated attacker could use this issue to possibly revoke access from others, contrary to expected permissions. (CVE-2014-0060) Andres Freund discovered that PostgreSQL incorrectly handled validator functions. An authenticated attacker could possibly use this issue to escalate their privileges. (CVE-2014-0061) Andres Freund discovered that PostgreSQL incorrectly handled concurrent CREATE INDEX statements. An authenticated attacker could possibly use this issue to obtain access to restricted data, bypassing intended privileges. (CVE-2014-0062) Daniel Schussler discovered that PostgreSQL incorrectly handled datetime input. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-0063) It was discovered that PostgreSQL incorrectly handled certain size calculations. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-0064) Peter Eisentraut and Jozef Mlich discovered that PostgreSQL incorrectly handled certain buffer sizes. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-0065) Honza Horak discovered that PostgreSQL incorrectly used the crypt() library function. This issue could possibly cause PostgreSQL to crash, resulting in a denial of service (CVE-2014-0066) Affected Software/OS: 'postgresql-8.4, postgresql-9.1' package(s) on Ubuntu 10.04, Ubuntu 12.04, Ubuntu 12.10, Ubuntu 13.10. Solution: Please install the updated package(s). CVSS Score: 6.5 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2014-0060 61307 http://secunia.com/advisories/61307 APPLE-SA-2014-10-16-3 http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html DSA-2864 http://www.debian.org/security/2014/dsa-2864 DSA-2865 http://www.debian.org/security/2014/dsa-2865 RHSA-2014:0211 http://rhn.redhat.com/errata/RHSA-2014-0211.html RHSA-2014:0221 http://rhn.redhat.com/errata/RHSA-2014-0221.html RHSA-2014:0249 http://rhn.redhat.com/errata/RHSA-2014-0249.html RHSA-2014:0469 http://rhn.redhat.com/errata/RHSA-2014-0469.html USN-2120-1 http://www.ubuntu.com/usn/USN-2120-1 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 http://support.apple.com/kb/HT6448 http://wiki.postgresql.org/wiki/20140220securityrelease http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html http://www.postgresql.org/about/news/1506/ https://puppet.com/security/cve/cve-2014-0060 https://support.apple.com/kb/HT6536 openSUSE-SU-2014:0345 http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html openSUSE-SU-2014:0368 http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html Common Vulnerability Exposure (CVE) ID: CVE-2014-0061 Common Vulnerability Exposure (CVE) ID: CVE-2014-0062 65727 http://www.securityfocus.com/bid/65727 Common Vulnerability Exposure (CVE) ID: CVE-2014-0063 65719 http://www.securityfocus.com/bid/65719 http://www.postgresql.org/support/security/ https://bugzilla.redhat.com/show_bug.cgi?id=1065226 https://github.com/postgres/postgres/commit/4318daecc959886d001a6e79c6ea853e8b1dfb4b Common Vulnerability Exposure (CVE) ID: CVE-2014-0064 65725 http://www.securityfocus.com/bid/65725 https://bugzilla.redhat.com/show_bug.cgi?id=1065230 https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a Common Vulnerability Exposure (CVE) ID: CVE-2014-0065 65731 http://www.securityfocus.com/bid/65731 Common Vulnerability Exposure (CVE) ID: CVE-2014-0066
Copyright	Copyright (C) 2014 Greenbone AG

This is only one of 146377 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.