Risk | Low |
Patch available | YES |
Number of vulnerabilities | 2 |
CVE-ID | CVE-2017-12172 CVE-2017-15098 |
CWE-ID | CWE-264 CWE-19 |
Exploitation vector | Network |
Public exploit | N/A |
Vulnerable software Subscribe |
Amazon Linux AMI Operating systems & Components / Operating system |
Vendor | Amazon Web Services |
Security Bulletin
This security bulletin contains information about 2 vulnerabilities.
EUVDB-ID: #VU9169
Risk: Low
CVSSv3.1: 2.9 [CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-12172
CWE-ID:
CWE-264 - Permissions, Privileges, and Access Controls
Exploit availability: No
DescriptionThe vulnerability allows a local attacker to cause DoS condition or obtain potentially sensitive information on a targeted system.
The weakness exists due to a flaw in certain non-default startup scripts. A local attacker with the privileges of the database server can create a symbolic link from the $PGLOG file to a critical file and modify the target file.
Update the affected packages.
i686:Vulnerable software versions
postgresql92-plperl-9.2.24-1.65.amzn1.i686
postgresql92-debuginfo-9.2.24-1.65.amzn1.i686
postgresql92-server-compat-9.2.24-1.65.amzn1.i686
postgresql92-plpython27-9.2.24-1.65.amzn1.i686
postgresql92-devel-9.2.24-1.65.amzn1.i686
postgresql92-server-9.2.24-1.65.amzn1.i686
postgresql92-libs-9.2.24-1.65.amzn1.i686
postgresql92-contrib-9.2.24-1.65.amzn1.i686
postgresql92-9.2.24-1.65.amzn1.i686
postgresql92-test-9.2.24-1.65.amzn1.i686
postgresql92-pltcl-9.2.24-1.65.amzn1.i686
postgresql92-plpython26-9.2.24-1.65.amzn1.i686
postgresql92-docs-9.2.24-1.65.amzn1.i686
postgresql94-plpython27-9.4.15-1.73.amzn1.i686
postgresql94-debuginfo-9.4.15-1.73.amzn1.i686
postgresql94-docs-9.4.15-1.73.amzn1.i686
postgresql94-libs-9.4.15-1.73.amzn1.i686
postgresql94-devel-9.4.15-1.73.amzn1.i686
postgresql94-server-9.4.15-1.73.amzn1.i686
postgresql94-plperl-9.4.15-1.73.amzn1.i686
postgresql94-9.4.15-1.73.amzn1.i686
postgresql94-test-9.4.15-1.73.amzn1.i686
postgresql94-plpython26-9.4.15-1.73.amzn1.i686
postgresql94-contrib-9.4.15-1.73.amzn1.i686
postgresql93-pltcl-9.3.20-1.69.amzn1.i686
postgresql93-test-9.3.20-1.69.amzn1.i686
postgresql93-plpython26-9.3.20-1.69.amzn1.i686
postgresql93-libs-9.3.20-1.69.amzn1.i686
postgresql93-server-9.3.20-1.69.amzn1.i686
postgresql93-docs-9.3.20-1.69.amzn1.i686
postgresql93-contrib-9.3.20-1.69.amzn1.i686
postgresql93-devel-9.3.20-1.69.amzn1.i686
postgresql93-debuginfo-9.3.20-1.69.amzn1.i686
postgresql93-plpython27-9.3.20-1.69.amzn1.i686
postgresql93-9.3.20-1.69.amzn1.i686
postgresql93-plperl-9.3.20-1.69.amzn1.i686
src:
postgresql92-9.2.24-1.65.amzn1.src
postgresql94-9.4.15-1.73.amzn1.src
postgresql93-9.3.20-1.69.amzn1.src
x86_64:
postgresql92-docs-9.2.24-1.65.amzn1.x86_64
postgresql92-plpython27-9.2.24-1.65.amzn1.x86_64
postgresql92-test-9.2.24-1.65.amzn1.x86_64
postgresql92-9.2.24-1.65.amzn1.x86_64
postgresql92-server-compat-9.2.24-1.65.amzn1.x86_64
postgresql92-pltcl-9.2.24-1.65.amzn1.x86_64
postgresql92-plperl-9.2.24-1.65.amzn1.x86_64
postgresql92-devel-9.2.24-1.65.amzn1.x86_64
postgresql92-server-9.2.24-1.65.amzn1.x86_64
postgresql92-libs-9.2.24-1.65.amzn1.x86_64
postgresql92-contrib-9.2.24-1.65.amzn1.x86_64
postgresql92-plpython26-9.2.24-1.65.amzn1.x86_64
postgresql92-debuginfo-9.2.24-1.65.amzn1.x86_64
postgresql94-contrib-9.4.15-1.73.amzn1.x86_64
postgresql94-plperl-9.4.15-1.73.amzn1.x86_64
postgresql94-devel-9.4.15-1.73.amzn1.x86_64
postgresql94-server-9.4.15-1.73.amzn1.x86_64
postgresql94-libs-9.4.15-1.73.amzn1.x86_64
postgresql94-plpython26-9.4.15-1.73.amzn1.x86_64
postgresql94-debuginfo-9.4.15-1.73.amzn1.x86_64
postgresql94-plpython27-9.4.15-1.73.amzn1.x86_64
postgresql94-test-9.4.15-1.73.amzn1.x86_64
postgresql94-9.4.15-1.73.amzn1.x86_64
postgresql94-docs-9.4.15-1.73.amzn1.x86_64
postgresql93-server-9.3.20-1.69.amzn1.x86_64
postgresql93-devel-9.3.20-1.69.amzn1.x86_64
postgresql93-test-9.3.20-1.69.amzn1.x86_64
postgresql93-plperl-9.3.20-1.69.amzn1.x86_64
postgresql93-plpython27-9.3.20-1.69.amzn1.x86_64
postgresql93-docs-9.3.20-1.69.amzn1.x86_64
postgresql93-9.3.20-1.69.amzn1.x86_64
postgresql93-pltcl-9.3.20-1.69.amzn1.x86_64
postgresql93-contrib-9.3.20-1.69.amzn1.x86_64
postgresql93-plpython26-9.3.20-1.69.amzn1.x86_64
postgresql93-libs-9.3.20-1.69.amzn1.x86_64
postgresql93-debuginfo-9.3.20-1.69.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2017-931.html
Q & A
Can this vulnerability be exploited remotely?
No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
EUVDB-ID: #VU9168
Risk: Low
CVSSv3.1: 5.7 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L/E:U/RL:O/RC:C]
CVE-ID: CVE-2017-15098
CWE-ID:
CWE-19 - Data Handling
Exploit availability: No
DescriptionThe vulnerability allows a remote authenticated attacker to cause DoS condition or obtain potentially sensitive information on a targeted system.
The weakness exists due to improper data handling. A remote attacker can send specially crafted data to trigger a rowtype mismatch in json{b}_populate_recordset(), cause the application to crash or read arbitrary data.
Update the affected packages.
i686:Vulnerable software versions
postgresql92-plperl-9.2.24-1.65.amzn1.i686
postgresql92-debuginfo-9.2.24-1.65.amzn1.i686
postgresql92-server-compat-9.2.24-1.65.amzn1.i686
postgresql92-plpython27-9.2.24-1.65.amzn1.i686
postgresql92-devel-9.2.24-1.65.amzn1.i686
postgresql92-server-9.2.24-1.65.amzn1.i686
postgresql92-libs-9.2.24-1.65.amzn1.i686
postgresql92-contrib-9.2.24-1.65.amzn1.i686
postgresql92-9.2.24-1.65.amzn1.i686
postgresql92-test-9.2.24-1.65.amzn1.i686
postgresql92-pltcl-9.2.24-1.65.amzn1.i686
postgresql92-plpython26-9.2.24-1.65.amzn1.i686
postgresql92-docs-9.2.24-1.65.amzn1.i686
postgresql94-plpython27-9.4.15-1.73.amzn1.i686
postgresql94-debuginfo-9.4.15-1.73.amzn1.i686
postgresql94-docs-9.4.15-1.73.amzn1.i686
postgresql94-libs-9.4.15-1.73.amzn1.i686
postgresql94-devel-9.4.15-1.73.amzn1.i686
postgresql94-server-9.4.15-1.73.amzn1.i686
postgresql94-plperl-9.4.15-1.73.amzn1.i686
postgresql94-9.4.15-1.73.amzn1.i686
postgresql94-test-9.4.15-1.73.amzn1.i686
postgresql94-plpython26-9.4.15-1.73.amzn1.i686
postgresql94-contrib-9.4.15-1.73.amzn1.i686
postgresql93-pltcl-9.3.20-1.69.amzn1.i686
postgresql93-test-9.3.20-1.69.amzn1.i686
postgresql93-plpython26-9.3.20-1.69.amzn1.i686
postgresql93-libs-9.3.20-1.69.amzn1.i686
postgresql93-server-9.3.20-1.69.amzn1.i686
postgresql93-docs-9.3.20-1.69.amzn1.i686
postgresql93-contrib-9.3.20-1.69.amzn1.i686
postgresql93-devel-9.3.20-1.69.amzn1.i686
postgresql93-debuginfo-9.3.20-1.69.amzn1.i686
postgresql93-plpython27-9.3.20-1.69.amzn1.i686
postgresql93-9.3.20-1.69.amzn1.i686
postgresql93-plperl-9.3.20-1.69.amzn1.i686
src:
postgresql92-9.2.24-1.65.amzn1.src
postgresql94-9.4.15-1.73.amzn1.src
postgresql93-9.3.20-1.69.amzn1.src
x86_64:
postgresql92-docs-9.2.24-1.65.amzn1.x86_64
postgresql92-plpython27-9.2.24-1.65.amzn1.x86_64
postgresql92-test-9.2.24-1.65.amzn1.x86_64
postgresql92-9.2.24-1.65.amzn1.x86_64
postgresql92-server-compat-9.2.24-1.65.amzn1.x86_64
postgresql92-pltcl-9.2.24-1.65.amzn1.x86_64
postgresql92-plperl-9.2.24-1.65.amzn1.x86_64
postgresql92-devel-9.2.24-1.65.amzn1.x86_64
postgresql92-server-9.2.24-1.65.amzn1.x86_64
postgresql92-libs-9.2.24-1.65.amzn1.x86_64
postgresql92-contrib-9.2.24-1.65.amzn1.x86_64
postgresql92-plpython26-9.2.24-1.65.amzn1.x86_64
postgresql92-debuginfo-9.2.24-1.65.amzn1.x86_64
postgresql94-contrib-9.4.15-1.73.amzn1.x86_64
postgresql94-plperl-9.4.15-1.73.amzn1.x86_64
postgresql94-devel-9.4.15-1.73.amzn1.x86_64
postgresql94-server-9.4.15-1.73.amzn1.x86_64
postgresql94-libs-9.4.15-1.73.amzn1.x86_64
postgresql94-plpython26-9.4.15-1.73.amzn1.x86_64
postgresql94-debuginfo-9.4.15-1.73.amzn1.x86_64
postgresql94-plpython27-9.4.15-1.73.amzn1.x86_64
postgresql94-test-9.4.15-1.73.amzn1.x86_64
postgresql94-9.4.15-1.73.amzn1.x86_64
postgresql94-docs-9.4.15-1.73.amzn1.x86_64
postgresql93-server-9.3.20-1.69.amzn1.x86_64
postgresql93-devel-9.3.20-1.69.amzn1.x86_64
postgresql93-test-9.3.20-1.69.amzn1.x86_64
postgresql93-plperl-9.3.20-1.69.amzn1.x86_64
postgresql93-plpython27-9.3.20-1.69.amzn1.x86_64
postgresql93-docs-9.3.20-1.69.amzn1.x86_64
postgresql93-9.3.20-1.69.amzn1.x86_64
postgresql93-pltcl-9.3.20-1.69.amzn1.x86_64
postgresql93-contrib-9.3.20-1.69.amzn1.x86_64
postgresql93-plpython26-9.3.20-1.69.amzn1.x86_64
postgresql93-libs-9.3.20-1.69.amzn1.x86_64
postgresql93-debuginfo-9.3.20-1.69.amzn1.x86_64
Amazon Linux AMI: All versions
External linkshttp://alas.aws.amazon.com/ALAS-2017-931.html
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.