CVE-2010-0733: Integer Overflow
An integer overflow flaw was found in the way postgresql used to calculate size for the hashtable for joined relations. An attacker could formulate a specially-crafted sql query, which once processed would lead to denial of service (postgresql daemon crash).
Upstream bug report: -------------------- [1] http://archives.postgresql.org/pgsql-bugs/2009-10/msg00277.php
References: ----------- [2] http://archives.postgresql.org/pgsql-bugs/2009-10/msg00287.php [3] http://archives.postgresql.org/pgsql-bugs/2009-10/msg00310.php [4] http://archives.postgresql.org/pgsql-bugs/2009-10/msg00289.php
Upstream patch: --------------- git clone git://git.postgresql.org/git/postgresql.git cd postgresql && git show 64b057e6823655fb6c5d1f24a28f236b94dd6c54
Credit: ------- Bernt Marius Johnsen
Other sources
Integer overflow in src/backend/executor/nodeHash.c in PostgreSQL 8.4.1 and earlier, and 8.5 through 8.5alpha2, allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with many LEFT JOIN clauses, related to certain hashtable size calculations.
— Red Hat
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2010-0733?
CVE-2010-0733 has a medium severity level as it allows remote authenticated users to cause denial of service through specific SQL queries.
How do I fix CVE-2010-0733?
To fix CVE-2010-0733, upgrade to PostgreSQL version 8.4.2 or later, as these versions include the necessary patches.
Which PostgreSQL versions are affected by CVE-2010-0733?
CVE-2010-0733 affects PostgreSQL versions 8.4.1 and earlier, as well as 8.5 through 8.5alpha2.
What type of vulnerability is CVE-2010-0733?
CVE-2010-0733 is classified as an integer overflow vulnerability leading to a denial of service.
Can CVE-2010-0733 be exploited without authentication?
No, CVE-2010-0733 requires remote authenticated users to exploit the vulnerability.