CVE-2007-3279
First published: Tue Jun 19 2007(Updated: )
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| PostgreSQL JDBC Driver | =8.1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://osvdb.org/40900
- http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:188
- http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf
- http://www.securityfocus.com/archive/1/471541/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35144
Frequently Asked Questions
What is the severity of CVE-2007-3279?
CVE-2007-3279 is considered a high severity vulnerability due to the unauthorized execution of functions by attackers.
How do I fix CVE-2007-3279?
To fix CVE-2007-3279, restrict PL/pgSQL privileges by modifying the permissions for the PUBLIC role in PostgreSQL.
What versions of PostgreSQL are affected by CVE-2007-3279?
CVE-2007-3279 affects PostgreSQL version 8.1 and likely later versions.
What types of attacks can be executed due to CVE-2007-3279?
Due to CVE-2007-3279, attackers can perform local brute-force password guessing attacks by creating and executing functions.
Is CVE-2007-3279 exploitable remotely?
Yes, CVE-2007-3279 is exploitable remotely if the PL/pgSQL language is improperly configured in PostgreSQL.
- agent/references
- agent/type
- agent/weakness
- agent/severity
- agent/author
- agent/description
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/postgresql
- canonical/postgresql jdbc driver
- version/postgresql jdbc driver/8.1