CVE-2010-3433: Medium severity PostgreSQL postgresql vulnerability

Published Oct 1, 2010

Updated

A flaw was found in the way PostgreSQL handled SQL functions, created with SECURITY DEFINER keyword and implemented in PL/Perl or PL/Tcl languages. Once the PL/Perl or PL/Tcl procedural language was registered on particular database, a remote, authenticated user, running a specially-crafted PL/Perl or PL/Tcl script could use this flaw to bypass intended PostgreSQL SECURITY DEFINER function definition refinement / protection mechanism, allowing them to run particular PostgreSQL function under their effective user ID, potentially leading to escalation of their privileges.

References: [1] http://www.postgresql.org/docs/8.1/interactive/plperl.html [2] http://www.postgresql.org/docs/8.1/static/pltcl.html [3] http://www.postgresql.org/docs/8.1/interactive/sql-createfunction.html

Other sources

The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.

Affected Software

114 affected components

PostgreSQL postgresql=7.4.16

PostgreSQL postgresql=7.4.24

PostgreSQL postgresql=7.4.22

PostgreSQL postgresql=7.4.21

PostgreSQL postgresql=7.4.19

PostgreSQL postgresql=7.4.15

PostgreSQL postgresql=7.4.1

PostgreSQL postgresql=7.4.14

PostgreSQL postgresql=7.4.26

PostgreSQL postgresql=7.4.6

PostgreSQL postgresql=7.4.23

PostgreSQL postgresql=7.4.11

PostgreSQL postgresql=7.4.7

PostgreSQL postgresql=7.4.17

PostgreSQL postgresql=7.4.3

PostgreSQL postgresql=7.4.25

PostgreSQL postgresql=7.4.9

PostgreSQL postgresql=7.4.5

PostgreSQL postgresql=7.4.18

PostgreSQL postgresql=7.4.8

PostgreSQL postgresql=7.4

PostgreSQL postgresql=7.4.4

PostgreSQL postgresql=7.4.28

PostgreSQL postgresql=7.4.12

PostgreSQL postgresql=7.4.27

PostgreSQL postgresql=7.4.10

PostgreSQL postgresql=7.4.29

PostgreSQL postgresql=7.4.20

PostgreSQL postgresql=7.4.2

PostgreSQL postgresql=7.4.13

PostgreSQL postgresql=8.0.7

PostgreSQL postgresql=8.0.2

PostgreSQL postgresql=8.0.22

PostgreSQL postgresql=8.0.25

PostgreSQL postgresql=8.0.17

PostgreSQL postgresql=8.0.10

PostgreSQL postgresql=8.0.12

PostgreSQL postgresql=8.0.9

PostgreSQL postgresql=8.0.15

PostgreSQL postgresql=8.0.18

PostgreSQL postgresql=8.0.3

PostgreSQL postgresql=8.0.24

PostgreSQL postgresql=8.0.20

PostgreSQL postgresql=8.0.8

PostgreSQL postgresql=8.0.6

PostgreSQL postgresql=8.0.16

PostgreSQL postgresql=8.0.13

PostgreSQL postgresql=8.0.1

PostgreSQL postgresql=8.0.19

PostgreSQL postgresql=8.0.21

PostgreSQL postgresql=8.0.23

PostgreSQL postgresql=8.0.4

PostgreSQL postgresql=8.0.5

PostgreSQL postgresql=8.0.14

PostgreSQL postgresql=8.0.11

PostgreSQL postgresql=8.0

PostgreSQL postgresql=8.1.10

PostgreSQL postgresql=8.1.6

PostgreSQL postgresql=8.1.15

PostgreSQL postgresql=8.1.7

PostgreSQL postgresql=8.1.20

PostgreSQL postgresql=8.1

PostgreSQL postgresql=8.1.19

PostgreSQL postgresql=8.1.13

PostgreSQL postgresql=8.1.3

PostgreSQL postgresql=8.1.9

PostgreSQL postgresql=8.1.14

PostgreSQL postgresql=8.1.21

PostgreSQL postgresql=8.1.11

PostgreSQL postgresql=8.1.17

PostgreSQL postgresql=8.1.18

PostgreSQL postgresql=8.1.4

PostgreSQL postgresql=8.1.8

PostgreSQL postgresql=8.1.1

PostgreSQL postgresql=8.1.12

PostgreSQL postgresql=8.1.5

PostgreSQL postgresql=8.1.16

PostgreSQL postgresql=8.1.2

PostgreSQL postgresql=8.2.9

PostgreSQL postgresql=8.2.17

PostgreSQL postgresql=8.2.10

PostgreSQL postgresql=8.2.15

PostgreSQL postgresql=8.2.4

PostgreSQL postgresql=8.2.11

PostgreSQL postgresql=8.2.12

PostgreSQL postgresql=8.2.2

PostgreSQL postgresql=8.2.5

PostgreSQL postgresql=8.2.1

PostgreSQL postgresql=8.2.7

PostgreSQL postgresql=8.2.6

PostgreSQL postgresql=8.2.3

PostgreSQL postgresql=8.2.16

PostgreSQL postgresql=8.2.8

PostgreSQL postgresql=8.2.13

PostgreSQL postgresql=8.2

PostgreSQL postgresql=8.2.14

PostgreSQL postgresql=8.3.6

PostgreSQL postgresql=8.3.3

PostgreSQL postgresql=8.3.2

PostgreSQL postgresql=8.3.1

PostgreSQL postgresql=8.3.5

PostgreSQL postgresql=8.3.8

PostgreSQL postgresql=8.3.7

PostgreSQL postgresql=8.3.10

PostgreSQL postgresql=8.3

PostgreSQL postgresql=8.3.4

PostgreSQL postgresql=8.3.11

PostgreSQL postgresql=8.3.9

PostgreSQL postgresql=8.4.4

PostgreSQL postgresql=8.4.1

PostgreSQL postgresql=8.4.3

PostgreSQL postgresql=8.4

PostgreSQL postgresql=8.4.2

PostgreSQL postgresql=9.0

Remediation

Patch Available

http://www.postgresql.org/about/news.1244

Event History

Oct 1, 2010

Data Sourced

03:11 PM

DescriptionSeverityAffected Software

Oct 6, 2010

CVE Published

via MITRE·04:00 PM

Data Sourced

via MITRE·04:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3433?

CVE-2010-3433 is considered to have a medium severity level due to its potential impact on database security when exploiting SQL functions.

Who is affected by CVE-2010-3433?

CVE-2010-3433 affects PostgreSQL versions from 7.4 to 9.0 that have PL/Perl or PL/Tcl languages registered.

How can I fix CVE-2010-3433?

To fix CVE-2010-3433, upgrade to a patched version of PostgreSQL that mitigates this vulnerability.

What type of vulnerability is CVE-2010-3433?

CVE-2010-3433 is a vulnerability related to improper handling of SQL functions in PostgreSQL.

Can CVE-2010-3433 be exploited remotely?

Yes, CVE-2010-3433 can be exploited remotely by an authenticated user with specific SQL function privileges.