#VU41873 Permissions, Privileges, and Access Controls in PostgreSQL - CVE-2014-0061
Vulnerability identifier: #VU41873
Vulnerability risk: Low
CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]
CVE-ID:
CWE-ID:
CWE-264
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
PostgreSQL
Server applications /
Database software
Vendor: PostgreSQL Global Development Group
Description
The vulnerability allows a remote #AU# to read and manipulate data.
The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.
Mitigation
Install update from vendor's website.
Vulnerable software versions
PostgreSQL: 8.4.1 - 8.4.18, 9.0 - 9.0.15, 9.1 - 9.1.11, 9.2 - 9.2.6, 9.3 - 9.3.2
External links
https://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
https://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
https://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html
https://rhn.redhat.com/errata/RHSA-2014-0211.html
https://rhn.redhat.com/errata/RHSA-2014-0221.html
https://rhn.redhat.com/errata/RHSA-2014-0249.html
https://rhn.redhat.com/errata/RHSA-2014-0469.html
https://secunia.com/advisories/61307
https://support.apple.com/kb/HT6448
https://wiki.postgresql.org/wiki/20140220securityrelease
https://www.debian.org/security/2014/dsa-2864
https://www.debian.org/security/2014/dsa-2865
https://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
https://www.postgresql.org/about/news/1506/
https://www.ubuntu.com/usn/USN-2120-1
https://support.apple.com/kb/HT6536
Q & A
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.
