Test ID:	1.3.6.1.4.1.25623.1.0.880763
Category:	CentOS Local Security Checks
Title:	CentOS Update for perl-DBD-Pg CESA-2009:0479 centos5 i386
Summary:	The remote host is missing an update for the 'perl-DBD-Pg'; package(s) announced via the referenced advisory.
Description:	Summary: The remote host is missing an update for the 'perl-DBD-Pg' package(s) announced via the referenced advisory. Vulnerability Insight: Perl DBI is a database access Application Programming Interface (API) for the Perl language. perl-DBD-Pg allows Perl applications to access PostgreSQL database servers. A heap-based buffer overflow flaw was discovered in the pg_getline function implementation. If the pg_getline or getline functions read large, untrusted records from a database, it could cause an application using these functions to crash or, possibly, execute arbitrary code. (CVE-2009-0663) Note: After installing this update, pg_getline may return more data than specified by its second argument, as this argument will be ignored. This is consistent with current upstream behavior. Previously, the length limit (the second argument) was not enforced, allowing a buffer overflow. A memory leak flaw was found in the function performing the de-quoting of BYTEA type values acquired from a database. An attacker able to cause an application using perl-DBD-Pg to perform a large number of SQL queries returning BYTEA records, could cause the application to use excessive amounts of memory or, possibly, crash. (CVE-2009-1341) All users of perl-DBD-Pg are advised to upgrade to this updated package, which contains backported patches to fix these issues. Applications using perl-DBD-Pg must be restarted for the update to take effect. Affected Software/OS: perl-DBD-Pg on CentOS 5 Solution: Please install the updated packages. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2009-0663 BugTraq ID: 34755 http://www.securityfocus.com/bid/34755 Debian Security Information: DSA-1780 (Google Search) http://www.debian.org/security/2009/dsa-1780 https://launchpad.net/bugs/cve/2009-0663 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9499 http://www.redhat.com/support/errata/RHSA-2009-0479.html http://www.redhat.com/support/errata/RHSA-2009-1067.html http://secunia.com/advisories/34909 http://secunia.com/advisories/35058 http://secunia.com/advisories/35685 SuSE Security Announcement: SUSE-SR:2009:012 (Google Search) http://lists.opensuse.org/opensuse-security-announce/2009-07/msg00002.html XForce ISS Database: libdbdpgperl-unspecified-bo(50467) https://exchange.xforce.ibmcloud.com/vulnerabilities/50467 Common Vulnerability Exposure (CVE) ID: CVE-2009-1341 BugTraq ID: 34757 http://www.securityfocus.com/bid/34757 https://launchpad.net/bugs/cve/2009-1341 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9680 XForce ISS Database: libdbdpgperl-dequotebytea-dos(50387) https://exchange.xforce.ibmcloud.com/vulnerabilities/50387
Copyright	Copyright (C) 2011 Greenbone AG

This is only one of 145615 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.