REDHAT-BUG-1707102: Medium severity EnterpriseDB PostgreSQL vulnerability

Published May 6, 2019

Updated

The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of the binary installation directory or the ACL of the data directory; it keeps the inherited ACL. In the default configuration, this allows a local attacker to read arbitrary data directory files, essentially bypassing database-imposed read access limitations. In plausible non-default configurations, an attacker having both an unprivileged Windows account and an unprivileged PostgreSQL account can cause the PostgreSQL service account to execute arbitrary code.

Affected Software

1 affected component

EnterpriseDB PostgreSQL

Event History

May 6, 2019

Data Sourced

via Red Hat·07:53 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-1707102?

The severity of REDHAT-BUG-1707102 is considered to be high due to the potential for local attackers to access sensitive data.

How do I fix REDHAT-BUG-1707102?

To fix REDHAT-BUG-1707102, you should manually adjust the Access Control List (ACL) settings for the binary and data directories to ensure they are properly secured.

What types of vulnerabilities does REDHAT-BUG-1707102 expose?

REDHAT-BUG-1707102 exposes vulnerabilities related to access control, allowing local attackers to read arbitrary files from the data directory.

Who is affected by REDHAT-BUG-1707102?

Users of the EnterpriseDB-supplied PostgreSQL on Windows are affected by REDHAT-BUG-1707102.

What are the potential implications of REDHAT-BUG-1707102?

The implications of REDHAT-BUG-1707102 include unauthorized access to sensitive data, which could lead to data breaches or exposure of confidential information.