CVE-2014-0064: Buffer Overflow
Multiple integer overflow flaws, leading to buffer overflows, were found in PostgreSQL. An authenticated database user could possibly use these flaws to crash the PostgreSQL server or execute arbitrary code.
Acknowledgements:
Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Heikki Linnakangas and Noah Misch as the original reporters.
Other sources
Multiple integer overflows in the pathin and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 8.4.20 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.0.16 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.1.12 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.2.7 - Upgrade
Upgrade
PostgreSQLto a version that resolves this vulnerability.Fixed in 9.3.3
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0064?
CVE-2014-0064 is classified as a high severity vulnerability due to the potential for remote code execution and denial of service.
How do I fix CVE-2014-0064?
To remediate CVE-2014-0064, upgrade PostgreSQL to a version that is not affected, specifically above 9.3.4.
What systems are affected by CVE-2014-0064?
CVE-2014-0064 affects PostgreSQL versions 8.4.x through 9.3.3.
Can CVE-2014-0064 be exploited remotely?
Yes, CVE-2014-0064 can be exploited by an authenticated user to cause crashes or execute arbitrary code which might lead to broader system access.
Is user authentication sufficient to mitigate CVE-2014-0064?
No, simply having user authentication does not mitigate the risks associated with CVE-2014-0064, as an authenticated user can exploit the vulnerability.