CVE-2012-0866: Medium severity postgresql common vulnerability

Published Jul 18, 2012

Updated

CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by installing the trigger on an attacker-owned table.

Affected Software

39 affected components

PostgreSQL postgresql=8.3

PostgreSQL postgresql=8.3.1

PostgreSQL postgresql=8.3.2

PostgreSQL postgresql=8.3.3

PostgreSQL postgresql=8.3.4

PostgreSQL postgresql=8.3.5

PostgreSQL postgresql=8.3.6

PostgreSQL postgresql=8.3.7

PostgreSQL postgresql=8.3.8

PostgreSQL postgresql=8.3.9

PostgreSQL postgresql=8.3.10

PostgreSQL postgresql=8.3.11

PostgreSQL postgresql=8.3.12

PostgreSQL postgresql=8.3.13

PostgreSQL postgresql=8.3.14

PostgreSQL postgresql=8.3.15

PostgreSQL postgresql=8.3.16

PostgreSQL postgresql=8.3.17

PostgreSQL postgresql=8.4

PostgreSQL postgresql=8.4.1

PostgreSQL postgresql=8.4.2

PostgreSQL postgresql=8.4.3

PostgreSQL postgresql=8.4.4

PostgreSQL postgresql=8.4.5

PostgreSQL postgresql=8.4.6

PostgreSQL postgresql=8.4.7

PostgreSQL postgresql=8.4.8

PostgreSQL postgresql=8.4.9

PostgreSQL postgresql=8.4.10

PostgreSQL postgresql=9.0

PostgreSQL postgresql=9.0.1

PostgreSQL postgresql=9.0.2

PostgreSQL postgresql=9.0.3

PostgreSQL postgresql=9.0.4

PostgreSQL postgresql=9.0.5

PostgreSQL postgresql=9.0.6

PostgreSQL postgresql=9.1

PostgreSQL postgresql=9.1.1

PostgreSQL postgresql=9.1.2

Event History

Jul 18, 2012

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2012-0866?

The severity of CVE-2012-0866 is considered to be medium, as it allows remote authenticated users to execute restricted triggers.

How do I fix CVE-2012-0866?

To fix CVE-2012-0866, upgrade PostgreSQL to versions 8.3.18, 8.4.11, 9.0.7, or 9.1.3 or later.

Who is affected by CVE-2012-0866?

CVE-2012-0866 affects users of PostgreSQL versions 8.3.x prior to 8.3.18, 8.4.x prior to 8.4.11, 9.0.x prior to 9.0.7, and 9.1.x prior to 9.1.3.

What does CVE-2012-0866 exploit?

CVE-2012-0866 exploits insufficient permission checks for trigger functions that are marked as SECURITY DEFINER.

Can CVE-2012-0866 allow unauthorized access?

Yes, CVE-2012-0866 can allow remote authenticated users to execute triggers they should not have access to, potentially leading to unauthorized data manipulation.