Vulnerability Assessment & Network Security Forums
If through a vulnerability assessment, a network security issue is detected for the vulnerability below, applying the appropriate security patches in a timely matter is very important. If you have detected that your system has already been compromised, following CERT's Network Security recovery document will assist with recommended steps for system recovery.
Vulnerability Assessment Details
Check for the version of the postgresql packages
Detailed Explanation for this Vulnerability Assessment
Updated PostgreSQL packages are available which correct
several minor security vulnerabilities.
[Updated 06 Feb 2003]
Added fixed packages for Advanced Workstation 2.1
PostgreSQL is an advanced Object-Relational database management system
(DBMS). Red Hat Linux Advanced Server 2.1 shipped with PostgreSQL version
7.1.3 which has several security vulnerabilities.
Buffer overflows in PostgreSQL 7.2 permit attackers to cause a denial of
service and possibly execute arbitrary code via long arguments to the lpad
or rpad functions. CVE-2002-0972
Buffer overflow in the cash_words() function for PostgreSQL 7.2 and
earlier permits local users to cause a denial of service and possibly
execute arbitrary code via a malformed argument. CVE-2002-1397
Buffer overflow in the date parser for PostgreSQL before 7.2.2 permits
attackers to cause a denial of service and possibly execute arbitrary
code via a long date string, referred to as a vulnerability "in handling
long datetime input." CVE-2002-1398
Heap-based buffer overflow in the repeat() function for PostgreSQL
before 7.2.2 permits attackers to execute arbitrary code by causing
repeat() to generate a large string. CVE-2002-1400
Buffer overflows in circle_poly, path_encode, and path_add permit attackers
to cause a denial of service and possibly execute arbitrary code. Note
that these issues have been fixed in our packages and in PostgreSQL CVS,
but are not included in PostgreSQL version 7.2.2 or 7.2.3. CVE-2002-1401
Buffer overflows in the TZ and SET TIME ZONE enivronment variables for
PostgreSQL 7.2.1 and earlier permit local users to cause a denial of service
and possibly execute arbitrary code. CVE-2002-1402
Note that these vulnerabilities are only critical on open or shared systems
because connecting to the database is required before the vulnerabilities
can be exploited.
The PostgreSQL Global Development Team has released versions of PostgreSQL
that fix these vulnerabilities, and these fixes have been isolated and
backported into the updated 7.1.3 packages provided with this errata.
All users of Red Hat Linux Advanced Server 2.1 who use PostgreSQL are
advised to install these updated packages.
Solution : http://rhn.redhat.com/errata/RHSA-2002-301.html
Network Security Threat Level: High
Networks Security ID:
Vulnerability Assessment Copyright: This script is Copyright (C) 2004 Tenable Network Security
|Cisco PIX 515 Firewall
|Dell SonicWALL NSA 4500 HA Network Security Appliance 1RK13-051 Transferable
|Netgear ProSecure Unified Threat Management UTM150 Security Appliance Firewall
|Juniper Networks SSG5 SSG-5-SH-MW-US 7 Port Wireless Router Firewall VPN Gateway
No Discussions have been posted on this vulnerability.