CVE-2006-0678: Low severity PostgreSQL postgresql vulnerability

Published Feb 14, 2006

Updated

PostgreSQL 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3, when compiled with Asserts enabled, allows local users to cause a denial of service (server crash) via a crafted SET SESSION AUTHORIZATION command, a different vulnerability than CVE-2006-0553.

Affected Software

36 affected components

PostgreSQL postgresql=8.0.2

PostgreSQL postgresql=7.3.3

PostgreSQL postgresql=7.3

PostgreSQL postgresql=8.1

PostgreSQL postgresql=7.4.1

PostgreSQL postgresql=7.3.9

PostgreSQL postgresql=7.3.10

PostgreSQL postgresql=7.4.6

PostgreSQL postgresql=7.4.11

PostgreSQL postgresql=8.0.3

PostgreSQL postgresql=7.4.7

PostgreSQL postgresql=7.3.11

PostgreSQL postgresql=7.4.3

PostgreSQL postgresql=7.3.6

PostgreSQL postgresql=7.4.9

PostgreSQL postgresql=7.4.5

PostgreSQL postgresql=7.3.8

PostgreSQL postgresql=7.4.8

PostgreSQL postgresql=8.0.6

PostgreSQL postgresql=7.4

PostgreSQL postgresql=7.4.4

PostgreSQL postgresql=7.3.13

PostgreSQL postgresql=8.0.1

PostgreSQL postgresql=7.3.2

PostgreSQL postgresql=7.3.5

PostgreSQL postgresql=7.3.12

PostgreSQL postgresql=8.1.1

PostgreSQL postgresql=7.3.1

PostgreSQL postgresql=7.4.10

PostgreSQL postgresql=8.0.4

PostgreSQL postgresql=8.0.5

PostgreSQL postgresql=7.3.7

PostgreSQL postgresql=7.4.2

PostgreSQL postgresql=8.0

PostgreSQL postgresql=7.3.4

PostgreSQL postgresql=8.1.2

Remediation

Patch Available

http://secunia.com/advisories/18890

Event History

Feb 14, 2006

CVE Published

07:06 PM

Feb 15, 2006

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2006-0678?

CVE-2006-0678 is classified as a denial of service vulnerability that allows local users to crash the PostgreSQL server.

How do I fix CVE-2006-0678?

To mitigate CVE-2006-0678, upgrade PostgreSQL to version 7.3.14, 7.4.12, 8.0.7, or 8.1.3 or later.

Which versions of PostgreSQL are affected by CVE-2006-0678?

CVE-2006-0678 affects PostgreSQL versions 7.3.x before 7.3.14, 7.4.x before 7.4.12, 8.0.x before 8.0.7, and 8.1.x before 8.1.3 when compiled with Asserts enabled.

Can CVE-2006-0678 be exploited remotely?

CVE-2006-0678 cannot be exploited remotely as it requires local access to the PostgreSQL server.

What command is used to exploit CVE-2006-0678?

The vulnerability can be triggered via a crafted SET SESSION AUTHORIZATION command.