#VU32338 Permissions, Privileges, and Access Controls in PostgreSQL
Vulnerability identifier: #VU32338
Vulnerability risk: High
CVSSv3.1: 7.7 [CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-264
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
PostgreSQL
Server applications /
Database software
Vendor: PostgreSQL Global Development Group
Description
The vulnerability allows a remote authenticated user to execute arbitrary code.
PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 does not properly restrict access to unspecified custom configuration settings (GUCS) for PL/Java, which allows attackers to gain privileges via unspecified vectors.
Mitigation
Install update from vendor's website.
Vulnerable software versions
PostgreSQL: 9.1.0 - 9.1.19, 9.2.0 - 9.2.14, 9.3.0 - 9.3.10, 9.4.0 - 9.4.5, 9.5.0
External links
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00049.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00052.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00054.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00056.html
http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00016.html
http://www.debian.org/security/2016/dsa-3475
http://www.debian.org/security/2016/dsa-3476
http://www.postgresql.org/about/news/1644/
http://www.postgresql.org/docs/current/static/release-9-1-20.html
http://www.postgresql.org/docs/current/static/release-9-2-15.html
http://www.postgresql.org/docs/current/static/release-9-3-11.html
http://www.postgresql.org/docs/current/static/release-9-4-6.html
http://www.postgresql.org/docs/current/static/release-9-5-1.html
http://www.securityfocus.com/bid/83184
http://www.securitytracker.com/id/1035005
http://www.ubuntu.com/usn/USN-2894-1
http://security.gentoo.org/glsa/201701-33
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
