SQL injection vulnerability in Quassel IRC before 0.9.1, when Qt 4.8.5 or later and PostgreSQL 8.2 or later are used, allows remote attackers to execute arbitrary SQL commands via a \ (backslash) in a message.

Buffer overflow in the gettoken function in contrib/intarray/intbool.c in the intarray array module in PostgreSQL 9.0.x before 9.0.3, 8.4.x before 8.4.7, 8.3.x before 8.3.14, and 8.2.x before 8.2.20 allows remote authenticated users to cause a denial of service (crash) and possibly execute arbitrary code via integers with a large number of digits to unspecified functions.

PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly handle a '\0' character in a domain name in the subject's Common Name (CN) field of an X.509 certificate, which (1) allows man-in-the-middle attackers to spoof arbitrary SSL-based PostgreSQL servers via a crafted server certificate issued by a legitimate Certification Authority, and (2) allows remote attackers to bypass intended client-hostname restrictions via a crafted client certificate issued by a legitimate Certification Authority, a related issue to CVE-2009-2408.

Description of problem: All currently shipped versions of PostgreSQL are vulnerable to a new type of attack pointed out by Gurjeet Singh. The scenario is similar to CVE-2007-6600 in that an attacker must be an authenticated user so that he can create a table with attached indexes, which reference functions he has created. Subsequent maintenance operations performed by database superusers will then have to execute those functions. In -6600 the threat was simply to acquire the caller's privileges directly. However, another possibility is that the index function can modify session-local state in a way that will subvert later operations in the same session. Examples include changing the searchpath so that an attacker-created function will be invoked instead of the intended one, or replacing an existing prepared statement with a new one containing code of the attacker's choosing. There have up to now been only very limited security controls on most session-local state, so it was easy to think of possible attack vectors once the basic issue was recognized.

This attack is less dangerous than -6600 since it only succeeds if the calling session does something subvert-able later. In particular it's not clear that there's any major risk for automatic vacuum operations. But superusers who do manual vacuuming or reindexing are clearly at risk.

Upstream versions due to be announced Monday 12-14 contain assorted fixes meant to mitigate this scenario.

Quoting upstream PostgreSQL security page: http://www.postgresql.org/support/security.html

Authenticated non-superusers can shut down the backend server by re-LOAD-ing libraries in $libdir/plugins, if any libraries are present there.

Affected versions: 8.4, 8.3, 8.2

Fixed in versions: 8.4.1, 8.3.8, 8.2.14

Severity: D - A vulnerability that is exploitable for denial-of-service, but requiring a valid prior login.

Quoting upstream PostgreSQL security page: http://www.postgresql.org/support/security.html

The fix for issue CVE-2007-2138 (below) failed to include protection against misuse of RESET SESSION AUTHORIZATION.

Affected versions: 8.4, 8.3, 8.2, 8.1, 8.0, 7.4 (note: this may affect previous 7.x versions too, but upstream does not support pre-7.4 versions any more)

Fixed in versions: 8.4.1, 8.3.8, 8.2.14, 8.1.18, 8.0.22, 7.4.26

Severity: C - A vulnerabilty that is exploitable for privilege escalation, but requiring a valid prior login.

CVE-2007-2138 was previously tracked via bug #237680 and bug #237682, more info on the updates addressing this flaw is available at: https://www.redhat.com/security/data/cve/CVE-2007-2138.html

Quoting upstream PostgreSQL security page: http://www.postgresql.org/support/security.html

If PostgreSQL is configured with LDAP authentication, and your LDAP configuration allows anonymous binds, it is possible for a user to authenticate themselves with an empty password.

Affected versions: 8.3, 8.2

Fixed in versions: 8.3.8, 8.2.14

Severity: A - A vulnerability that is exploitable for privilege escalation without requiring a prior login.