#VU32715 Input validation error in PostgreSQL - CVE-2013-0255

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU32715

#VU32715 Input validation error in PostgreSQL - CVE-2013-0255

Published: February 13, 2013 / Updated: July 28, 2020


Vulnerability identifier: #VU32715
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2013-0255
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability: No public exploit available
Vulnerable software:
PostgreSQL
Software vendor:
PostgreSQL Global Development Group

Description

The vulnerability allows a remote #AU# to perform a denial of service (DoS) attack.

PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.


Remediation

Install update from vendor's website.

External links