CVE-2009-3231: Medium severity postgresql common vulnerability
Quoting upstream PostgreSQL security page: http://www.postgresql.org/support/security.html
If PostgreSQL is configured with LDAP authentication, and your LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password.
Affected versions: 8.3, 8.2
Fixed in versions: 8.3.8, 8.2.14
Severity: A - A vulnerability that is exploitable for privilege escalation without requiring a prior login.
Other sources
The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-3231?
CVE-2009-3231 is classified as a moderate severity vulnerability due to its ability to allow bypassing LDAP authentication.
How do I fix CVE-2009-3231?
To resolve CVE-2009-3231, you should upgrade to PostgreSQL version 8.3.8 or later for version 8.3 or 8.2.14 or later for version 8.2.
What systems are affected by CVE-2009-3231?
CVE-2009-3231 affects PostgreSQL versions 8.3 before 8.3.8 and 8.2 before 8.2.14, as well as certain vulnerable Linux distributions using these PostgreSQL versions.
What happens if I don't mitigate CVE-2009-3231?
Failure to mitigate CVE-2009-3231 could allow unauthorized remote attackers to bypass authentication and gain access to the database.
What type of authentication is vulnerable in CVE-2009-3231?
CVE-2009-3231 specifically affects LDAP authentication when using anonymous binds.