#VU41880 Permissions, Privileges, and Access Controls in PostgreSQL - CVE-2014-0060

Vulnerability identifier: #VU41880

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2014-0060

CWE-ID: CWE-264

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
PostgreSQL
Server applications / Database software

Vendor: PostgreSQL Global Development Group

Description

The vulnerability allows a remote #AU# to manipulate data.

PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.

Mitigation
Install update from vendor's website.

Vulnerable software versions

PostgreSQL: 8.4.1 - 8.4.18, 9.0 - 9.0.15, 9.1 - 9.1.11, 9.2 - 9.2.6, 9.3 - 9.3.2

---

External links
https://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
https://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
https://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
https://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html
https://rhn.redhat.com/errata/RHSA-2014-0211.html
https://rhn.redhat.com/errata/RHSA-2014-0221.html
https://rhn.redhat.com/errata/RHSA-2014-0249.html
https://rhn.redhat.com/errata/RHSA-2014-0469.html
https://secunia.com/advisories/61307
https://support.apple.com/kb/HT6448
https://wiki.postgresql.org/wiki/20140220securityrelease
https://www.debian.org/security/2014/dsa-2864
https://www.debian.org/security/2014/dsa-2865
https://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
https://www.postgresql.org/about/news/1506/
https://www.ubuntu.com/usn/USN-2120-1
https://puppet.com/security/cve/cve-2014-0060
https://support.apple.com/kb/HT6536

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.