Anfälligkeitssuche        Suche in 172616 CVE Beschreibungen
und 81291 Test Beschreibungen,
Zugriff auf 10,000+ Quellverweise.
Tests   CVE   Alle  

Test Kennung:1.3.6.1.4.1.25623.1.0.891874
Kategorie:Debian Local Security Checks
Titel:Debian LTS: Security Advisory for postgresql-9.4 (DLA-1874-1)
Zusammenfassung:The remote host is missing an update for the 'postgresql-9.4'; package(s) announced via the DLA-1874-1 advisory.
Beschreibung:Summary:
The remote host is missing an update for the 'postgresql-9.4'
package(s) announced via the DLA-1874-1 advisory.

Vulnerability Insight:
* CVE-2019-10208: `TYPE` in `pg_temp` executes arbitrary SQL during
`SECURITY DEFINER` execution

Versions Affected: 9.4 - 11

Given a suitable `SECURITY DEFINER` function, an attacker can execute
arbitrary SQL under the identity of the function owner. An attack
requires `EXECUTE` permission on the function, which must itself contain
a function call having inexact argument type match. For example,
`length('foo'::varchar)` and `length('foo')` are inexact, while
`length('foo'::text)` is exact. As part of exploiting this
vulnerability, the attacker uses `CREATE DOMAIN` to create a type in a
`pg_temp` schema. The attack pattern and fix are similar to that for
CVE-2007-2138.

Writing `SECURITY DEFINER` functions continues to require following the
considerations noted in the documentation:

The PostgreSQL project thanks Tom Lane for reporting this problem.

Affected Software/OS:
'postgresql-9.4' package(s) on Debian Linux.

Solution:
For Debian 8 'Jessie', this problem has been fixed in version
9.4.24-0+deb8u1.

We recommend that you upgrade your postgresql-9.4 packages.

CVSS Score:
6.5

CVSS Vector:
AV:N/AC:L/Au:S/C:P/I:P/A:P

Querverweis: Common Vulnerability Exposure (CVE) ID: CVE-2007-2138
BugTraq ID: 23618
http://www.securityfocus.com/bid/23618
Debian Security Information: DSA-1309 (Google Search)
http://www.debian.org/security/2007/dsa-1309
Debian Security Information: DSA-1311 (Google Search)
http://www.debian.org/security/2007/dsa-1311
http://security.gentoo.org/glsa/glsa-200705-12.xml
http://www.mandriva.com/security/advisories?name=MDKSA-2007:094
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10090
RedHat Security Advisories: RHSA-2007:0336
http://rhn.redhat.com/errata/RHSA-2007-0336.html
http://www.redhat.com/support/errata/RHSA-2007-0337.html
http://www.securitytracker.com/id?1017974
http://secunia.com/advisories/24989
http://secunia.com/advisories/24999
http://secunia.com/advisories/25005
http://secunia.com/advisories/25019
http://secunia.com/advisories/25037
http://secunia.com/advisories/25058
http://secunia.com/advisories/25184
http://secunia.com/advisories/25238
http://secunia.com/advisories/25334
http://secunia.com/advisories/25717
http://secunia.com/advisories/25720
http://secunia.com/advisories/25725
http://sunsolve.sun.com/search/document.do?assetkey=1-26-102894-1
http://www.trustix.org/errata/2007/0015/
http://www.ubuntu.com/usn/usn-454-1
http://www.vupen.com/english/advisories/2007/1497
http://www.vupen.com/english/advisories/2007/1549
XForce ISS Database: postgresql-searchpath-privilege-escalation(33842)
https://exchange.xforce.ibmcloud.com/vulnerabilities/33842
CopyrightCopyright (C) 2019 Greenbone Networks GmbH

Dies ist nur einer von 81291 Anfälligkeitstests in unserem Testpaket. Finden Sie mehr über unsere vollständigen Sicherheitsüberprüfungen heraus.

Um einen gratis Test für diese Anfälligkeit auf Ihrem System durchlaufen zu lassen, registrieren Sie sich bitte unten.




© 1998-2020 E-Soft Inc. Alle Rechte vorbehalten.