Input validation error in PostgreSQL - CVE-2013-1899
Published: April 4, 2013 / Updated: July 29, 2020
Vulnerability identifier: #VU32710
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2013-1899
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to perform a denial of service (DoS) attack.
The vulnerability exists due to insufficient validation of user-supplied input. A remote attacker can modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).
Affected software
PostgreSQL
Amazon Linux AMI
Gentoo Linux
Ubuntu
SUSE Linux
postgresql (Alpine package)
postgresql-8.3 (Ubuntu package)
postgresql-8.4 (Ubuntu package)
postgresql-9.1 (Ubuntu package)
Amazon Linux AMI
Gentoo Linux
Ubuntu
SUSE Linux
postgresql (Alpine package)
postgresql-8.3 (Ubuntu package)
postgresql-8.4 (Ubuntu package)
postgresql-9.1 (Ubuntu package)
How to mitigate CVE-2013-1899
Update to version 9.2.4.
PostgreSQL - update to 9.2.4
postgresql (Alpine package) - update to 9.1.9-r0
postgresql-8.3 (Ubuntu package) - update to 8.3.23-0ubuntu8.04.1
postgresql-8.4 (Ubuntu package) - update to 8.4.17-0ubuntu10.04
postgresql-9.1 (Ubuntu package) - addressed in versions 9.1.9-0ubuntu11.10, 9.1.9-0ubuntu12.04, 9.1.9-0ubuntu12.10
postgresql (Alpine package) - update to 9.1.9-r0
postgresql-8.3 (Ubuntu package) - update to 8.3.23-0ubuntu8.04.1
postgresql-8.4 (Ubuntu package) - update to 8.4.17-0ubuntu10.04
postgresql-9.1 (Ubuntu package) - addressed in versions 9.1.9-0ubuntu11.10, 9.1.9-0ubuntu12.04, 9.1.9-0ubuntu12.10
Links to Public Exploits and PoC-codes
External References
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html
- http://support.apple.com/kb/HT5880
- http://support.apple.com/kb/HT5892
- http://www.debian.org/security/2013/dsa-2658
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:142
- http://www.postgresql.org/about/news/1456/
- http://www.postgresql.org/docs/current/static/release-9-0-13.html
- http://www.postgresql.org/docs/current/static/release-9-1-9.html
- http://www.postgresql.org/docs/current/static/release-9-2-4.html
- http://www.postgresql.org/support/security/faq/2013-04-04/
- http://www.ubuntu.com/usn/USN-1789-1