CVE-2007-3279: Critical severity PostgreSQL postgresql vulnerability
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3279?
CVE-2007-3279 is considered a high severity vulnerability due to the unauthorized execution of functions by attackers.
How do I fix CVE-2007-3279?
To fix CVE-2007-3279, restrict PL/pgSQL privileges by modifying the permissions for the PUBLIC role in PostgreSQL.
What versions of PostgreSQL are affected by CVE-2007-3279?
CVE-2007-3279 affects PostgreSQL version 8.1 and likely later versions.
What types of attacks can be executed due to CVE-2007-3279?
Due to CVE-2007-3279, attackers can perform local brute-force password guessing attacks by creating and executing functions.
Is CVE-2007-3279 exploitable remotely?
Yes, CVE-2007-3279 is exploitable remotely if the PL/pgSQL language is improperly configured in PostgreSQL.