CVE-2010-0442: Buffer Overflow
Intevydis reported a buffer overflow in PostgreSQL's implementation of substring() function when called with negative length argument:
http://intevydis.blogspot.com/2010/01/postgresql-8023-bitsubstr-overflow.html
Following query triggers overflow / crash:
select substring(B'10101010101010101010101010101010101010101010101',33,-15);
Other sources
The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
— Red Hat
Affected Software
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2010-0442?
CVE-2010-0442 is classified as a denial of service vulnerability that can crash the PostgreSQL daemon.
How do I fix CVE-2010-0442?
To fix CVE-2010-0442, upgrade PostgreSQL to version 8.0.24, 8.1.21, 8.3.10, or later.
What versions of PostgreSQL are affected by CVE-2010-0442?
CVE-2010-0442 affects PostgreSQL versions 8.0.23, 8.1.11, and 8.3.8 specifically.
Can CVE-2010-0442 be exploited remotely?
Yes, CVE-2010-0442 can be exploited by remote authenticated users to cause a denial of service.
What impact does CVE-2010-0442 have on PostgreSQL?
CVE-2010-0442 can lead to a daemon crash and may result in other unspecified impacts.