Resource management error in PostgreSQL - CVE-2012-2655
Published: July 19, 2012 / Updated: July 28, 2020
Vulnerability identifier: #VU32771
CSH Severity: Low
CVSS v4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2012-2655
CWE-ID: CWE-399
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote #AU# to perform service disruption.
PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler.
Affected software
PostgreSQL
Amazon Linux AMI
Gentoo Linux
postgresql (Alpine package)
dev-db/postgresql-server
Amazon Linux AMI
Gentoo Linux
postgresql (Alpine package)
dev-db/postgresql-server
How to mitigate CVE-2012-2655
Install update from vendor's website.
PostgreSQL - update to 8.3.19
postgresql (Alpine package) - update to 9.0.8-r0
dev-db/postgresql-server - update to 9.1.5
postgresql (Alpine package) - update to 9.0.8-r0
dev-db/postgresql-server - update to 9.1.5
External References
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082258.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082292.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-June/082294.html
- http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html
- http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
- http://rhn.redhat.com/errata/RHSA-2012-1037.html
- http://secunia.com/advisories/50718
- http://www.debian.org/security/2012/dsa-2491
- http://www.mandriva.com/security/advisories?name=MDVSA-2012:092
- http://www.postgresql.org/about/news/1398/