SB2022102056 - Multiple vulnerabilities in Dell Security Management
Published: October 20, 2022
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 12 secuirty vulnerabilities.
1) Unprotected storage of credentials (CVE-ID: CVE-2019-10210)
2) Untrusted search path (CVE-ID: CVE-2019-10211)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to EnterpriseDB Windows installer bundles an OpenSSL library that tries to load configuration from a hard-coded location on the system. This location usually does not exists, therefore an attacker can create a folder, place malicious configuration file in it and execute the configuration.
3) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-10127)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the BigSQL Windows installer does not remove permissive ACL entries from installed files and directories. A local user can gain unauthorized access to PostgreSQL directory.
4) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-10128)
The vulnerability allows a local user to escalate privileges on the system.
The vulnerability exists due to the EnterpriseDB Windows installer does not remove permissive ACL entries from installed files and directories. A local user can gain unauthorized access to PostgreSQL directory.
5) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2019-10130)
The vulnerability allows a remote attacker to bypass certain security restrictions.
The vulnerability exists due to incorrect implementation of row security policies. A remote attacker can use statistics, generated for tables to bypass row security policies and gain access to restricted rows.
6) Stack-based buffer overflow (CVE-ID: CVE-2019-10164)
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error when processing users passwords. A remote authenticated user can change his/her password to a specially crafted string, trigger stack-based buffer overflow and execute arbitrary code on the target system or crash the PostgreSQL process.
Successful exploitation of this vulnerability may result in complete compromise of vulnerable system.
7) Improper access control (CVE-ID: CVE-2020-25694)
The vulnerability allows a remote attacker to gain unauthorized access to otherwise restricted functionality.
The vulnerability exists due to improper access restrictions. A remote attacker can perform a man-in-the-middle attack or observe clear-text transmissions and downgrade connection security settings.
8) SQL injection (CVE-ID: CVE-2020-25695)
The vulnerability allows a remote attacker to execute arbitrary SQL queries in database.
The vulnerability exists due to insufficient sanitization of user-supplied data. A remote authenticated attacker can send a specially crafted request to the affected application and execute arbitrary SQL commands within the application database.
Successful exploitation of this vulnerability may allow a remote attacker to read, delete, modify data in database and gain complete control over the affected application.
9) Input validation error (CVE-ID: CVE-2020-25696)
The vulnerability allows a remote attacker to compromise the target system.
The vulnerability exists due to the "\gset" meta-command does not distinguish variables that control psql behavior. A remote attacker can execute arbitrary code as the operating system account.
10) Untrusted search path (CVE-ID: CVE-2020-10733)
The vulnerability allows a local user to escalate privileges on he system.
The vulnerability exists due to Windows installer runs executables from uncontrolled directories. A local user can trick the victim to install PostgreSQL from a directory that contains a malicious files and execute arbitrary code on the system with elevated privileges.
Note, this vulnerability affects Windows installer only.
11) Untrusted search path (CVE-ID: CVE-2020-14350)
The vulnerability allows a remote user to escalate privileges within the database.
The vulnerability exists due to the way PostgreSQL handles CREATE EXTENSION statements. A remote user with permission to create objects in the new extension's schema
or a schema of a prerequisite extension can execute arbitrary SQL functions under the identity of the superuser in certain cases.
12) Security restrictions bypass (CVE-ID: CVE-2021-20229)
The vulnerability allows a remote user to gain access to sensitive information.
The vulnerability exists due to application does not properly impose security restrictions. A user having a SELECT privilege on an individual column can craft a special
query that returns all columns of the table. Additionally, a stored view that uses column-level privileges will have
incomplete column-usage bitmaps. In installations that depend on column-level
permissions for security, it is recommended to execute CREATE OR REPLACE on
all user-defined views to force them to be re-parsed.
Remediation
Install update from vendor's website.