CVE-2007-3278: Medium severity PostgreSQL postgresql vulnerability
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3278?
CVE-2007-3278 is classified as a medium severity vulnerability due to its potential for unauthorized SQL query execution.
How do I fix CVE-2007-3278?
To mitigate CVE-2007-3278, disable local trust authentication or restrict the usage of the dblink library.
Which versions of PostgreSQL are affected by CVE-2007-3278?
CVE-2007-3278 affects PostgreSQL versions 7.3 through 8.2, with local trust authentication enabled and dblink installed.
What type of attack is facilitated by CVE-2007-3278?
CVE-2007-3278 allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries.
Is there a workaround for CVE-2007-3278?
A possible workaround for CVE-2007-3278 is to configure PostgreSQL to disallow the use of dblink or change authentication methods.