RHSA-2008:0039: Moderate: postgresql security update
PostgreSQL is an advanced Object-Relational database management system(DBMS). The postgresql packages include the client programs and librariesneeded to access a PostgreSQL DBMS server.A privilege escalation flaw was discovered in PostgreSQL. An authenticatedattacker could create an index function that would be executed withadministrator privileges during database maintenance tasks, such asdatabase vacuuming. (CVE-2007-6600)A privilege escalation flaw was discovered in PostgreSQL's Database Linklibrary (dblink). An authenticated attacker could use dblink to possiblyescalate privileges on systems with "trust" or "ident" authenticationconfigured. Please note that dblink functionality is not enabled bydefault, and can only by enabled by a database administrator on systemswith the postgresql-contrib package installed.(CVE-2007-3278, CVE-2007-6601)All postgresql users should upgrade to these updated packages, whichinclude PostgreSQL 7.3.21 and resolve these issues.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of RHSA-2008:0039?
RHSA-2008:0039 is classified as a moderate severity vulnerability due to the potential for privilege escalation by an authenticated attacker.
How do I fix RHSA-2008:0039?
To mitigate RHSA-2008:0039, you should update PostgreSQL to the latest available version that resolves the privilege escalation flaw.
Who is affected by RHSA-2008:0039?
RHSA-2008:0039 affects users of PostgreSQL who have installed the vulnerable versions of the database software.
What type of vulnerability is RHSA-2008:0039?
RHSA-2008:0039 is a privilege escalation vulnerability that allows authenticated attackers to gain higher access privileges.
When was RHSA-2008:0039 disclosed?
RHSA-2008:0039 was disclosed in February 2008, prompting users to take action to secure their PostgreSQL installations.