vulnerability CVE-2009-3229 CVE-2009-3230 CVE-2009-3231

PostgreSQL: three vulnerabilities

Synthesis of the vulnerability

Three vulnerabilities of PostgreSQL can be used by an attacker to create a denial of service, to elevate his privileges, or to access to the service.

Severity: 2/4. Creation date: 09/09/2009.

Description of the vulnerability

Three vulnerabilities of PostgreSQL can be used by an attacker to create a denial of service, to elevate his privileges, or to access to the service. An authenticated attacker can reload libraries located under $libdir/plugins, in order to stop the service. [severity:1/4; CVE-2009-3229, >] An authenticated attacker can use RESET SESSION AUTHORIZATION, in order to execute queries with privileges of another user. [severity:2/4; CVE-2009-3230, >] When PostgreSQL uses a LDAP configuration allowing anonymous binds, an attacker can authenticate with an empty password. [severity:2/4; CVE-2009-3231, >]

Complete Vigil@nce bulletin

Access to the complete Vigil@nce bulletin

Characteristics

Title: PostgreSQL: three vulnerabilities. Keywords: AUTHORIZATION LDAP PostgreSQL RESET SESSION three vulnerabilities. Identifiers: 270408, 6784052, 6879165, 6879166, 6888545, BID-36314, CVE-2009-3229, CVE-2009-3230, CVE-2009-3231, DSA 1900-1, FEDORA-2009-9473, FEDORA-2009-9474, http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-16879165, MDVSA-2009:176, MDVSA-2009:177, MDVSA-2009:251-1, RHSA-2009:1461-01, RHSA-2009:1484-01, RHSA-2009:1485-01, SUSE-SR:2009:016, SUSE-SR:2009:017, TLSA-2009-29, VIGILANCE-VUL-9015.

Information sources

Publications and announces Source example: Security Information

Solutions for this vulnerability

Patch or workaround

Supplements

Vulnerability : re-LOAD-ing An authenticated attacker can reload libraries located under $libdir/plugins, in order to stop the service. Severity: 1/4. Identifiers: CVE-2009-3229.

Vulnerability : RESET SESSION AUTHORIZATION An authenticated attacker can use RESET SESSION AUTHORIZATION, in order to execute queries with privileges of another user. Severity: 2/4. Identifiers: CVE-2009-3230.

Vulnerability : LDAP authentication When PostgreSQL uses a LDAP configuration allowing anonymous binds, an attacker can authenticate with an empty password. Severity: 2/4. Identifiers: CVE-2009-3231.

Computer vulnerabilities tracking service

The Vigil@nce computer vulnerability tracking service alerts your teams of vulnerabilities or threats impacting your information system.
The Vigil@nce vulnerability database contains several thousand vulnerabilities.
This bulletin is published by the Vigil@nce team, which tracks computer vulnerabilities impacting systems and applications.
Technology watch team on vulnerabilities