Risk | Low |
Patch available | YES |
Number of vulnerabilities | 3 |
CVE-ID | CVE-2017-12172 CVE-2017-15099 CVE-2017-15098 |
CWE-ID | CWE-264 CWE-19 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Amazon Linux AMI Operating systems & Components / Operating system |
Vendor | Amazon Web Services |
Security Bulletin
This security bulletin contains information about 3 vulnerabilities.
EUVDB-ID: #VU9169
Risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-12172
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to cause DoS condition or obtain potentially sensitive information on a targeted system.
The weakness exists due to a flaw in certain non-default startup scripts. A local attacker with the privileges of the database server can create a symbolic link from the $PGLOG file to a critical file and modify the target file.
Update the affected packages.
i686:Vulnerable software versions
postgresql95-plperl-9.5.10-1.77.amzn1.i686
postgresql95-libs-9.5.10-1.77.amzn1.i686
postgresql95-debuginfo-9.5.10-1.77.amzn1.i686
postgresql95-devel-9.5.10-1.77.amzn1.i686
postgresql95-test-9.5.10-1.77.amzn1.i686
postgresql95-contrib-9.5.10-1.77.amzn1.i686
postgresql95-docs-9.5.10-1.77.amzn1.i686
postgresql95-9.5.10-1.77.amzn1.i686
postgresql95-plpython26-9.5.10-1.77.amzn1.i686
postgresql95-static-9.5.10-1.77.amzn1.i686
postgresql95-server-9.5.10-1.77.amzn1.i686
postgresql95-plpython27-9.5.10-1.77.amzn1.i686
postgresql96-plperl-9.6.6-1.79.amzn1.i686
postgresql96-plpython26-9.6.6-1.79.amzn1.i686
postgresql96-plpython27-9.6.6-1.79.amzn1.i686
postgresql96-devel-9.6.6-1.79.amzn1.i686
postgresql96-contrib-9.6.6-1.79.amzn1.i686
postgresql96-static-9.6.6-1.79.amzn1.i686
postgresql96-docs-9.6.6-1.79.amzn1.i686
postgresql96-libs-9.6.6-1.79.amzn1.i686
postgresql96-debuginfo-9.6.6-1.79.amzn1.i686
postgresql96-test-9.6.6-1.79.amzn1.i686
postgresql96-9.6.6-1.79.amzn1.i686
postgresql96-server-9.6.6-1.79.amzn1.i686
src:
postgresql95-9.5.10-1.77.amzn1.src
postgresql96-9.6.6-1.79.amzn1.src
x86_64:
postgresql95-server-9.5.10-1.77.amzn1.x86_64
postgresql95-devel-9.5.10-1.77.amzn1.x86_64
postgresql95-contrib-9.5.10-1.77.amzn1.x86_64
postgresql95-9.5.10-1.77.amzn1.x86_64
postgresql95-static-9.5.10-1.77.amzn1.x86_64
postgresql95-plpython27-9.5.10-1.77.amzn1.x86_64
postgresql95-libs-9.5.10-1.77.amzn1.x86_64
postgresql95-docs-9.5.10-1.77.amzn1.x86_64
postgresql95-plpython26-9.5.10-1.77.amzn1.x86_64
postgresql95-plperl-9.5.10-1.77.amzn1.x86_64
postgresql95-debuginfo-9.5.10-1.77.amzn1.x86_64
postgresql95-test-9.5.10-1.77.amzn1.x86_64
postgresql96-static-9.6.6-1.79.amzn1.x86_64
postgresql96-docs-9.6.6-1.79.amzn1.x86_64
postgresql96-plperl-9.6.6-1.79.amzn1.x86_64
postgresql96-libs-9.6.6-1.79.amzn1.x86_64
postgresql96-test-9.6.6-1.79.amzn1.x86_64
postgresql96-debuginfo-9.6.6-1.79.amzn1.x86_64
postgresql96-9.6.6-1.79.amzn1.x86_64
postgresql96-contrib-9.6.6-1.79.amzn1.x86_64
postgresql96-server-9.6.6-1.79.amzn1.x86_64
postgresql96-plpython26-9.6.6-1.79.amzn1.x86_64
postgresql96-devel-9.6.6-1.79.amzn1.x86_64
postgresql96-plpython27-9.6.6-1.79.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2017-930.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU9167
Risk: Low
CVSSv3.1: 6.4 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15099
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a remote attacker to bypass security restrictions on a targeted system.
The weakness exists due to improper security restrictions in the case of an arbiter specified by constraint name. A remote attacker can submit specially crafted INSERT requests and bypass security controls on the update path of 'INSERT ... ON CONFLICT DO UPDATE' function to conduct further attacks.
Update the affected packages.
i686:Vulnerable software versions
postgresql95-plperl-9.5.10-1.77.amzn1.i686
postgresql95-libs-9.5.10-1.77.amzn1.i686
postgresql95-debuginfo-9.5.10-1.77.amzn1.i686
postgresql95-devel-9.5.10-1.77.amzn1.i686
postgresql95-test-9.5.10-1.77.amzn1.i686
postgresql95-contrib-9.5.10-1.77.amzn1.i686
postgresql95-docs-9.5.10-1.77.amzn1.i686
postgresql95-9.5.10-1.77.amzn1.i686
postgresql95-plpython26-9.5.10-1.77.amzn1.i686
postgresql95-static-9.5.10-1.77.amzn1.i686
postgresql95-server-9.5.10-1.77.amzn1.i686
postgresql95-plpython27-9.5.10-1.77.amzn1.i686
postgresql96-plperl-9.6.6-1.79.amzn1.i686
postgresql96-plpython26-9.6.6-1.79.amzn1.i686
postgresql96-plpython27-9.6.6-1.79.amzn1.i686
postgresql96-devel-9.6.6-1.79.amzn1.i686
postgresql96-contrib-9.6.6-1.79.amzn1.i686
postgresql96-static-9.6.6-1.79.amzn1.i686
postgresql96-docs-9.6.6-1.79.amzn1.i686
postgresql96-libs-9.6.6-1.79.amzn1.i686
postgresql96-debuginfo-9.6.6-1.79.amzn1.i686
postgresql96-test-9.6.6-1.79.amzn1.i686
postgresql96-9.6.6-1.79.amzn1.i686
postgresql96-server-9.6.6-1.79.amzn1.i686
src:
postgresql95-9.5.10-1.77.amzn1.src
postgresql96-9.6.6-1.79.amzn1.src
x86_64:
postgresql95-server-9.5.10-1.77.amzn1.x86_64
postgresql95-devel-9.5.10-1.77.amzn1.x86_64
postgresql95-contrib-9.5.10-1.77.amzn1.x86_64
postgresql95-9.5.10-1.77.amzn1.x86_64
postgresql95-static-9.5.10-1.77.amzn1.x86_64
postgresql95-plpython27-9.5.10-1.77.amzn1.x86_64
postgresql95-libs-9.5.10-1.77.amzn1.x86_64
postgresql95-docs-9.5.10-1.77.amzn1.x86_64
postgresql95-plpython26-9.5.10-1.77.amzn1.x86_64
postgresql95-plperl-9.5.10-1.77.amzn1.x86_64
postgresql95-debuginfo-9.5.10-1.77.amzn1.x86_64
postgresql95-test-9.5.10-1.77.amzn1.x86_64
postgresql96-static-9.6.6-1.79.amzn1.x86_64
postgresql96-docs-9.6.6-1.79.amzn1.x86_64
postgresql96-plperl-9.6.6-1.79.amzn1.x86_64
postgresql96-libs-9.6.6-1.79.amzn1.x86_64
postgresql96-test-9.6.6-1.79.amzn1.x86_64
postgresql96-debuginfo-9.6.6-1.79.amzn1.x86_64
postgresql96-9.6.6-1.79.amzn1.x86_64
postgresql96-contrib-9.6.6-1.79.amzn1.x86_64
postgresql96-server-9.6.6-1.79.amzn1.x86_64
postgresql96-plpython26-9.6.6-1.79.amzn1.x86_64
postgresql96-devel-9.6.6-1.79.amzn1.x86_64
postgresql96-plpython27-9.6.6-1.79.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2017-930.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU9168
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15098
CWE-ID:
CWE-19 - Data Handling
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to cause DoS condition or obtain potentially sensitive information on a targeted system.
The weakness exists due to improper data handling. A remote attacker can send specially crafted data to trigger a rowtype mismatch in json{b}_populate_recordset(), cause the application to crash or read arbitrary data.
Update the affected packages.
i686:Vulnerable software versions
postgresql95-plperl-9.5.10-1.77.amzn1.i686
postgresql95-libs-9.5.10-1.77.amzn1.i686
postgresql95-debuginfo-9.5.10-1.77.amzn1.i686
postgresql95-devel-9.5.10-1.77.amzn1.i686
postgresql95-test-9.5.10-1.77.amzn1.i686
postgresql95-contrib-9.5.10-1.77.amzn1.i686
postgresql95-docs-9.5.10-1.77.amzn1.i686
postgresql95-9.5.10-1.77.amzn1.i686
postgresql95-plpython26-9.5.10-1.77.amzn1.i686
postgresql95-static-9.5.10-1.77.amzn1.i686
postgresql95-server-9.5.10-1.77.amzn1.i686
postgresql95-plpython27-9.5.10-1.77.amzn1.i686
postgresql96-plperl-9.6.6-1.79.amzn1.i686
postgresql96-plpython26-9.6.6-1.79.amzn1.i686
postgresql96-plpython27-9.6.6-1.79.amzn1.i686
postgresql96-devel-9.6.6-1.79.amzn1.i686
postgresql96-contrib-9.6.6-1.79.amzn1.i686
postgresql96-static-9.6.6-1.79.amzn1.i686
postgresql96-docs-9.6.6-1.79.amzn1.i686
postgresql96-libs-9.6.6-1.79.amzn1.i686
postgresql96-debuginfo-9.6.6-1.79.amzn1.i686
postgresql96-test-9.6.6-1.79.amzn1.i686
postgresql96-9.6.6-1.79.amzn1.i686
postgresql96-server-9.6.6-1.79.amzn1.i686
src:
postgresql95-9.5.10-1.77.amzn1.src
postgresql96-9.6.6-1.79.amzn1.src
x86_64:
postgresql95-server-9.5.10-1.77.amzn1.x86_64
postgresql95-devel-9.5.10-1.77.amzn1.x86_64
postgresql95-contrib-9.5.10-1.77.amzn1.x86_64
postgresql95-9.5.10-1.77.amzn1.x86_64
postgresql95-static-9.5.10-1.77.amzn1.x86_64
postgresql95-plpython27-9.5.10-1.77.amzn1.x86_64
postgresql95-libs-9.5.10-1.77.amzn1.x86_64
postgresql95-docs-9.5.10-1.77.amzn1.x86_64
postgresql95-plpython26-9.5.10-1.77.amzn1.x86_64
postgresql95-plperl-9.5.10-1.77.amzn1.x86_64
postgresql95-debuginfo-9.5.10-1.77.amzn1.x86_64
postgresql95-test-9.5.10-1.77.amzn1.x86_64
postgresql96-static-9.6.6-1.79.amzn1.x86_64
postgresql96-docs-9.6.6-1.79.amzn1.x86_64
postgresql96-plperl-9.6.6-1.79.amzn1.x86_64
postgresql96-libs-9.6.6-1.79.amzn1.x86_64
postgresql96-test-9.6.6-1.79.amzn1.x86_64
postgresql96-debuginfo-9.6.6-1.79.amzn1.x86_64
postgresql96-9.6.6-1.79.amzn1.x86_64
postgresql96-contrib-9.6.6-1.79.amzn1.x86_64
postgresql96-server-9.6.6-1.79.amzn1.x86_64
postgresql96-plpython26-9.6.6-1.79.amzn1.x86_64
postgresql96-devel-9.6.6-1.79.amzn1.x86_64
postgresql96-plpython27-9.6.6-1.79.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2017-930.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.