SB2017120817 - Red Hat update for postgresql
Published: December 8, 2017
Security Bulletin ID
SB2017120817
Severity
Low
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Local access
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Improper access control (CVE-ID: CVE-2017-12172)
The vulnerability allows a local attacker to cause DoS condition or obtain potentially sensitive information on a targeted system.The weakness exists due to a flaw in certain non-default startup scripts. A local attacker with the privileges of the database server can create a symbolic link from the $PGLOG file to a critical file and modify the target file.
2) Privilege escalation (CVE-ID: CVE-2017-15097)
The vulnerability allows a local attacker to gain elevated privileges on the target system.The weakness exists due to a race condition in several of the initialization and setup scripts. A local attacker with 'postgres' user privileges can obtain root privileges.
Remediation
Install update from vendor's website.