Vulnerability identifier: #VU41880
Vulnerability risk: Low
CVSSv3.1: 1.3 [CVSS:3.1/AV:N/AC:L/PR:/UI:N/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-264
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
PostgreSQL
Server applications /
Database software
Vendor: PostgreSQL Global Development Group
Description
The vulnerability allows a remote #AU# to manipulate data.
PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows remote authenticated members of a role to add or remove arbitrary users to that role by calling the SET ROLE command before the associated GRANT command.
Mitigation
Install update from vendor's website.
Vulnerable software versions
PostgreSQL: 8.4.1 - 8.4.18, 9.0 - 9.0.15, 9.1 - 9.1.11, 9.2 - 9.2.6, 9.3 - 9.3.2
External links
http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html
http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html
http://rhn.redhat.com/errata/RHSA-2014-0211.html
http://rhn.redhat.com/errata/RHSA-2014-0221.html
http://rhn.redhat.com/errata/RHSA-2014-0249.html
http://rhn.redhat.com/errata/RHSA-2014-0469.html
http://secunia.com/advisories/61307
http://support.apple.com/kb/HT6448
http://wiki.postgresql.org/wiki/20140220securityrelease
http://www.debian.org/security/2014/dsa-2864
http://www.debian.org/security/2014/dsa-2865
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
http://www.postgresql.org/about/news/1506/
http://www.ubuntu.com/usn/USN-2120-1
http://puppet.com/security/cve/cve-2014-0060
http://support.apple.com/kb/HT6536
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.