Lucene search
RootSSV:30152HistoryFeb 29, 2012 - 12:00 a.m.
PostgreSQL 8.x/9.x 存在多个安全漏洞
2012-02-2900:00:00
Root
www.seebug.org
131
0.009 Low
EPSS
Percentile
83.2%
CVE-2012-0866
CVE-2012-0867
CVE-2012-0868
PostgreSQL是一款对象关系型数据库管理系统，支持扩展的SQL标准子集
PostgreSQL存在多个安全漏洞，允许恶意用户绕过部分安全限制，进行伪造攻击或操作某些数据
-在触发函数上没有对CREATE TRIGGER进行正确的权限检查，可利用此漏洞标记触发函数为SECURITY DEFINER，可授权EXECUTE权限
-在校验SSL证书的公用名时不正确把名称截断为32个字符，可导致不正确校验伪造证书
-当向评注注入对象名时pg_dump存在输入过滤错误，可被利用通过换行字符转义评注，向DUMP脚本注入SQL命令
0
PostgreSQL 8.x
PostgreSQL 9.x
厂商解决方案
PostgreSQL
PostgreSQL 9.1.3, 9.0.7, 8.4.11或8.3.18已经修复此漏洞，建议用户下载使用：
http://www.postgresql.org/
Related
debian
debian
[SECURITY] [DSA 2418-1] postgresql-8.4 security update
2012-02-27 17:43:53
veracode
veracode
Spoofing Vulnerability
2019-05-02 04:41:15
Arbitrary Code Execution
2019-05-02 04:41:14
Privilege Escalation
2019-01-15 08:51:21
openvas
openvas
Mandriva Update for postgresql MDVSA-2012:026 (postgresql)
2012-03-07 00:00:00
CentOS Update for postgresql CESA-2012:0678 centos6
2012-07-30 00:00:00
Ubuntu Update for postgresql-9.1 USN-1378-1
2012-03-07 00:00:00
nessus
nessus
PostgreSQL < 8.4.11 / 9.0.7 / 9.1.3 Multiple Vulnerabilities
2013-05-14 00:00:00
PostgreSQL 8.3.x < 8.3.18 Multiple Vulnerabilities
2012-02-28 00:00:00
Fedora 16 : postgresql-9.1.3-1.fc16 (2012-2591)
2012-03-08 00:00:00
oraclelinux
oraclelinux
postgresql and postgresql84 security update
2012-05-21 00:00:00
postgresql and postgresql84 security update
2012-06-25 00:00:00
postgresql security update
2012-05-21 00:00:00
fedora
fedora
[SECURITY] Fedora 16 Update: postgresql-9.1.3-1.fc16
2012-03-08 04:54:15
[SECURITY] Fedora 17 Update: postgresql-9.1.3-1.fc17
2012-03-06 20:40:53
[SECURITY] Fedora 16 Update: postgresql-9.1.3-1.fc16
2012-03-08 04:01:20
securityvulns
securityvulns
[ MDVSA-2012:026 ] postgresql
2012-03-09 00:00:00
PostgreSQL vulnerabilities
2012-03-09 00:00:00
amazon
amazon
Medium: postgresql8
2012-05-23 10:08:00
ubuntu
ubuntu
PostgreSQL vulnerabilities
2012-02-28 00:00:00
redhat
redhat
(RHSA-2012:0678) Moderate: postgresql and postgresql84 security update
2012-05-21 00:00:00
(RHSA-2012:0677) Moderate: postgresql security update
2012-05-21 00:00:00
centos
centos
postgresql, postgresql84 security update
2012-05-21 16:41:51
postgresql security update
2012-05-21 16:39:19
freebsd
freebsd
databases/postgresql*-client -- multiple vulnerabilities
2012-02-27 00:00:00
osv
osv
postgresql-8.4 - several
2012-02-27 00:00:00
gentoo
gentoo
PostgreSQL: Multiple vulnerabilities
2012-09-28 00:00:00
nvd
nvd
cve
cve
prion
prion
Code injection
2012-07-18 23:55:00
Crlf injection
2012-07-18 23:55:00
Design/Logic Flaw
2012-07-18 23:55:00
cvelist
cvelist
postgresql
postgresql
Vulnerability in core server (CVE-2012-0868)
2012-07-18 23:55:00
Vulnerability in core server (CVE-2012-0867)
2012-07-18 23:55:00
Vulnerability in core server (CVE-2012-0866)
2012-07-18 23:55:00
ubuntucve
ubuntucve