REDHAT-BUG-583072: Medium severity postgresql vulnerability

Published Apr 16, 2010

Updated

A flaw was found in the way the PostgreSQL enforced permission checks on scripts written in PL/Tcl. Once the PL/Tcl procedural language was registered on particular database, a remote, authenticated user, privileged to create databases, running a specially-crafted PL/Tcl script, could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server.

References: [1] PostgreSQL PL/Tcl procedural language manual page: http://www.postgresql.org/docs/8.1/interactive/pltcl.html

Affected Software

1 affected component

PostgreSQL PL/Tcl

Event History

Apr 16, 2010

Data Sourced

via Red Hat·03:30 PM

DescriptionSeverityAffected Software

Frequently Asked Questions

What is the severity of REDHAT-BUG-583072?

The severity of REDHAT-BUG-583072 is considered high due to its potential impact on database security.

How do I fix REDHAT-BUG-583072?

To fix REDHAT-BUG-583072, you should apply the latest security patches provided by PostgreSQL for the PL/Tcl procedural language.

What systems are affected by REDHAT-BUG-583072?

REDHAT-BUG-583072 affects systems running PostgreSQL with the PL/Tcl procedural language registered.

Who is impacted by REDHAT-BUG-583072?

Remote, authenticated users with privileges to create databases may exploit REDHAT-BUG-583072.

What type of vulnerability is REDHAT-BUG-583072?

REDHAT-BUG-583072 is a permission check flaw in the PostgreSQL PL/Tcl scripting language.