CVE-2007-0556: Medium severity PostgreSQL postgresql vulnerability

Published Feb 6, 2007

Updated

The query planner in PostgreSQL before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2 does not verify that a table is compatible with a "previously made query plan," which allows remote authenticated users to cause a denial of service (server crash) and possibly access database content via an "ALTER COLUMN TYPE" SQL statement, which can be leveraged to read arbitrary memory from the server.

Affected Software

92 affected components

PostgreSQL postgresql=1.0

PostgreSQL postgresql=1.01

PostgreSQL postgresql=1.02

PostgreSQL postgresql=1.09

PostgreSQL postgresql=6.0

PostgreSQL postgresql=6.1

PostgreSQL postgresql=6.1.1

PostgreSQL postgresql=6.2

PostgreSQL postgresql=6.2.1

PostgreSQL postgresql=6.3

PostgreSQL postgresql=6.3.1

PostgreSQL postgresql=6.3.2

PostgreSQL postgresql=6.4

PostgreSQL postgresql=6.4.1

PostgreSQL postgresql=6.4.2

PostgreSQL postgresql=6.5

PostgreSQL postgresql=6.5.1

PostgreSQL postgresql=6.5.2

PostgreSQL postgresql=6.5.3

PostgreSQL postgresql=7.0

PostgreSQL postgresql=7.0.1

PostgreSQL postgresql=7.0.2

PostgreSQL postgresql=7.0.3

PostgreSQL postgresql=7.1

PostgreSQL postgresql=7.1.1

PostgreSQL postgresql=7.1.2

PostgreSQL postgresql=7.1.3

PostgreSQL postgresql=7.2

PostgreSQL postgresql=7.2.1

PostgreSQL postgresql=7.2.2

PostgreSQL postgresql=7.2.3

PostgreSQL postgresql=7.2.4

PostgreSQL postgresql=7.2.5

PostgreSQL postgresql=7.2.6

PostgreSQL postgresql=7.2.7

PostgreSQL postgresql=7.2.8

PostgreSQL postgresql=7.3

PostgreSQL postgresql=7.3.1

PostgreSQL postgresql=7.3.2

PostgreSQL postgresql=7.3.3

PostgreSQL postgresql=7.3.4

PostgreSQL postgresql=7.3.5

PostgreSQL postgresql=7.3.6

PostgreSQL postgresql=7.3.7

PostgreSQL postgresql=7.3.8

PostgreSQL postgresql=7.3.9

PostgreSQL postgresql=7.3.10

PostgreSQL postgresql=7.3.11

PostgreSQL postgresql=7.3.12

PostgreSQL postgresql=7.3.13

PostgreSQL postgresql=7.3.14

PostgreSQL postgresql=7.3.15

PostgreSQL postgresql=7.3.16

PostgreSQL postgresql=7.3.17

PostgreSQL postgresql=7.3.18

PostgreSQL postgresql=7.4

PostgreSQL postgresql=7.4.1

PostgreSQL postgresql=7.4.2

PostgreSQL postgresql=7.4.3

PostgreSQL postgresql=7.4.4

PostgreSQL postgresql=7.4.5

PostgreSQL postgresql=7.4.6

PostgreSQL postgresql=7.4.7

PostgreSQL postgresql=7.4.8

PostgreSQL postgresql=7.4.9

PostgreSQL postgresql=7.4.10

PostgreSQL postgresql=7.4.11

PostgreSQL postgresql=7.4.12

PostgreSQL postgresql=7.4.13

PostgreSQL postgresql=7.4.14

PostgreSQL postgresql=7.4.15

PostgreSQL postgresql=7.4.16

PostgreSQL postgresql=8.0

PostgreSQL postgresql=8.0.1

PostgreSQL postgresql=8.0.2

PostgreSQL postgresql=8.0.3

PostgreSQL postgresql=8.0.4

PostgreSQL postgresql=8.0.5

PostgreSQL postgresql=8.0.6

PostgreSQL postgresql=8.0.7

PostgreSQL postgresql=8.0.8

PostgreSQL postgresql=8.0.9

PostgreSQL postgresql=8.0.10

PostgreSQL postgresql=8.1

PostgreSQL postgresql=8.1.1

PostgreSQL postgresql=8.1.2

PostgreSQL postgresql=8.1.3

PostgreSQL postgresql=8.1.4

PostgreSQL postgresql=8.1.5

PostgreSQL postgresql=8.1.6

PostgreSQL postgresql=8.2

PostgreSQL postgresql=8.2.1

Event History

Feb 6, 2007

CVE Published

01:28 AM

CVE Published

via MITRE·06:00 AM

Data Sourced

via MITRE·06:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2007-0556?

CVE-2007-0556 has a high-severity rating due to its potential to cause a denial of service by crashing the server.

How do I fix CVE-2007-0556?

To fix CVE-2007-0556, upgrade PostgreSQL to versions 8.0.11, 8.1.7, or 8.2.2 or later.

Who is affected by CVE-2007-0556?

CVE-2007-0556 affects PostgreSQL versions before 8.0.11, 8.1 before 8.1.7, and 8.2 before 8.2.2.

What kind of attack can CVE-2007-0556 facilitate?

CVE-2007-0556 can facilitate a denial of service attack, potentially allowing remote users to crash the database server.

What components of PostgreSQL are involved in CVE-2007-0556?

CVE-2007-0556 involves the query planner in PostgreSQL that fails to verify table compatibility with previously made query plans.