CVE-2012-3489: Input Validation
An XML External Entities (XXE) attack was found in the way xmlparse routine, used for producing of xml data type value from character data, of PostgreSQL, an advanced Object-Relational database management system (DBMS), performed parsing of provided character data. An unprivileged database user could issue a specially-crafted SQL query to the PostgreSQL server that, when processed could lead to attacker's ability to read arbitrary system files, accessible with privileges of the user running the PostgreSQL server.
References: [1] http://www.postgresql.org/docs/8.3/static/release-8-3-20.html [2] http://www.postgresql.org/docs/9.0/static/release-9-0-9.html [3] http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
Other sources
The xmlparse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2012-3489?
CVE-2012-3489 has a medium severity rating due to its potential exploitation through XML External Entities (XXE) attacks.
How do I fix CVE-2012-3489?
To fix CVE-2012-3489, update your PostgreSQL version to at least 9.1.5, 9.0.9, or 8.4.13.
Which versions of PostgreSQL are affected by CVE-2012-3489?
CVE-2012-3489 affects PostgreSQL versions prior to 9.1.5, 9.0.9, and 8.4.13.
Can unprivileged users exploit CVE-2012-3489?
Yes, unprivileged database users can exploit CVE-2012-3489 due to improper XML parsing.
What types of attacks can CVE-2012-3489 facilitate?
CVE-2012-3489 can facilitate XML External Entities (XXE) attacks, allowing attackers to access internal files or perform server-side request forgery.