#VU32770 Input validation error in PostgreSQL - CVE-2012-3489

Vulnerability identifier: #VU32770

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2012-3489

CWE-ID: CWE-20

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
PostgreSQL
Server applications / Database software

Vendor: PostgreSQL Global Development Group

Description

The vulnerability allows a remote #AU# to gain access to sensitive information.

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.

Mitigation
Install update from vendor's website.

Vulnerable software versions

PostgreSQL: 8.3 - 8.3.19

---

External links
https://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
https://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html
https://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html
https://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html
https://rhn.redhat.com/errata/RHSA-2012-1263.html
https://secunia.com/advisories/50635
https://secunia.com/advisories/50718
https://secunia.com/advisories/50859
https://secunia.com/advisories/50946
https://www.debian.org/security/2012/dsa-2534
https://www.mandriva.com/security/advisories?name=MDVSA-2012:139
https://www.postgresql.org/about/news/1407/
https://www.postgresql.org/docs/8.3/static/release-8-3-20.html
https://www.postgresql.org/docs/8.4/static/release-8-4-13.html
https://www.postgresql.org/docs/9.0/static/release-9-0-9.html
https://www.postgresql.org/docs/9.1/static/release-9-1-5.html
https://www.postgresql.org/support/security/
https://www.securityfocus.com/bid/55074
https://www.ubuntu.com/usn/USN-1542-1
https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2
https://bugzilla.redhat.com/show_bug.cgi?id=849173

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.