CVE-1999-0862: Low severity PostgreSQL postgresql vulnerability
Insecure directory permissions in RPM distribution for PostgreSQL allows local users to gain privileges by reading a plaintext password file.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Remove
Remove
plaintext password file installed by PostgreSQL Common RPMfrom your environment.Delete the plaintext password file if it is not required. If credentials are required, relocate them to a secure credential store or a file protected with restrictive permissions accessible only to the service account.
- Configuration
Change the permissions on the RPM-installed PostgreSQL directories and the plaintext password file so only the package owner (e.g., the 'postgres' account) can read them; remove group and other read permissions.
PostgreSQL Common (RPM distribution) directory and password-file permissions = restrict to package owner only; remove group/other read access - Compensating control
Until the RPM is corrected or a vendor patch is applied, restrict local user access on affected hosts (disable or remove untrusted local accounts, limit shell/login access to trusted administrators) and enforce host-based access controls to prevent unprivileged users from reading package files.
- Operational
Rotate any passwords or credentials that were stored in the plaintext password file and revoke or replace any credentials that may have been exposed before restoring secure storage and permissions.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-0862?
CVE-1999-0862 has a medium severity rating due to the potential for local users to gain unauthorized privileges.
How do I fix CVE-1999-0862?
To fix CVE-1999-0862, ensure that directory permissions for PostgreSQL are correctly set to prevent unauthorized access to sensitive files.
Who is affected by CVE-1999-0862?
CVE-1999-0862 affects local users of specific versions of PostgreSQL, particularly versions 6.3.2, 6.5.3, and 6.5.3.1.
What are the potential impacts of CVE-1999-0862?
The potential impacts of CVE-1999-0862 include unauthorized access to plaintext passwords and increased risk of privilege escalation.
Is CVE-1999-0862 a historical vulnerability?
Yes, CVE-1999-0862 is considered a historical vulnerability, documented back in 1999, but it highlights the importance of secure file permissions.