Safe.pm 2.26 and earlier (except 2.20 through 2.23 if using a threads-enabled Perl), when used in Perl 5.10.0 and earlier, may allow attackers to break out of safe compartment in (1) Safe::reval or (2) Safe::rdo using subroutine references, whose execution is delayed to happen outside of the safe compartment. If a victim was tricked into running a specially-crafted Perl script, using Safe extension module, it could lead to intended Safe module restrictions bypass, if the returned subroutine reference was called from outside of the compartment. Different vulnerability than CVE-2010-1168.
Solution: Ugrade to Safe.pm v2.27 or higher.
References: [1] http://search.cpan.org/~rgarcia/Safe-2.27/Safe.pm
Acknowledgements:
Red Hat would like to thank Tim Bunce for responsibly reporting this flaw. Upstream credits also Rafaël Garcia-Suarez for discovering of this issue.
A flaw was found in the way the PostgreSQL enforced permission checks on scripts written in PL/Perl. Once the PL/Perl procedural language was registered on particular database, a remote, authenticated user, privileged to create databases, running a specially-crafted PL/Perl script, could use this flaw to bypass intended PL/Perl trusted mode restrictions, allowing them to run arbitrary Perl scripts with the privileges of the database server.
References: [1] PostgreSQL PL/Perl procedural language manual page: http://www.postgresql.org/docs/8.1/interactive/plperl.html [2] PostgreSQL Trusted and Untrusted PL/Perl mode manual page: http://www.postgresql.org/docs/8.1/interactive/plperl-trusted.html
Acknowledgements:
Red Hat would like to thank Tim Bunce for responsibly reporting this issue.
A typical CREATE USER MAPPING command persists a foreign password in an "option" of the user mapping. Contrary to its documentation and at variance with the informationschema.usermappingoptions view, the pgusermappings view discloses user mapping options to any user having USAGE privilege on the associated foreign server. If someone revokes the USAGE grant, an attacker having captured the password this way might use it to connect another way. An attacker may use the password to run arbitrary queries against the server or others accepting the same credentials, not just the limited queries one can issue via foreign tables.
Affected versions: 8.4 - 9.6
An XML External Entities (XXE) attack was found in the way xmlparse routine, used for producing of xml data type value from character data, of PostgreSQL, an advanced Object-Relational database management system (DBMS), performed parsing of provided character data. An unprivileged database user could issue a specially-crafted SQL query to the PostgreSQL server that, when processed could lead to attacker's ability to read arbitrary system files, accessible with privileges of the user running the PostgreSQL server.
References: [1] http://www.postgresql.org/docs/8.3/static/release-8-3-20.html [2] http://www.postgresql.org/docs/9.0/static/release-9-0-9.html [3] http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
Intevydis reported a buffer overflow in PostgreSQL's implementation of substring() function when called with negative length argument:
http://intevydis.blogspot.com/2010/01/postgresql-8023-bitsubstr-overflow.html
Following query triggers overflow / crash:
select substring(B'10101010101010101010101010101010101010101010101',33,-15);
A flaw was found in the way the PostgreSQL enforced permission checks on scripts written in PL/Tcl. Once the PL/Tcl procedural language was registered on particular database, a remote, authenticated user, privileged to create databases, running a specially-crafted PL/Tcl script, could use this flaw to bypass intended PL/Tcl trusted mode restrictions, allowing them to run arbitrary Tcl scripts with the privileges of the database server.
References: [1] PostgreSQL PL/Tcl procedural language manual page: http://www.postgresql.org/docs/8.1/interactive/pltcl.html
A flaw was found in the way PostgreSQL handled SQL functions, created with SECURITY DEFINER keyword and implemented in PL/Perl or PL/Tcl languages. Once the PL/Perl or PL/Tcl procedural language was registered on particular database, a remote, authenticated user, running a specially-crafted PL/Perl or PL/Tcl script could use this flaw to bypass intended PostgreSQL SECURITY DEFINER function definition refinement / protection mechanism, allowing them to run particular PostgreSQL function under their effective user ID, potentially leading to escalation of their privileges.
References: [1] http://www.postgresql.org/docs/8.1/interactive/plperl.html [2] http://www.postgresql.org/docs/8.1/static/pltcl.html [3] http://www.postgresql.org/docs/8.1/interactive/sql-createfunction.html
PostgreSQL 7.4 before 7.4.29, 8.0 before 8.0.25, 8.1 before 8.1.21, 8.2 before 8.2.17, 8.3 before 8.3.11, and 8.4 before 8.4.4 does not properly check privileges during certain RESET ALL operations, which allows remote authenticated users to remove arbitrary parameter settings via a (1) ALTER USER or (2) ALTER DATABASE statement.
An XML External Entities (XXE) attack was found in the way xml2 contrib module, providing XPath querying and XSLT functionality, of PostgreSQL, an advanced Object-Relational database management system (DBMS), performed processing of XSLT documents. When the xml2 contrib module was enabled an unprivileged database user could issue a specially-crafted SQL query to the PostgreSQL server that, when processed could lead to attacker's ability to read or write (alter) arbitrary system files, accessible with the privileges of the user running the PostgreSQL server.
References: [1] http://www.postgresql.org/docs/8.3/static/release-8-3-20.html [2] http://www.postgresql.org/docs/9.0/static/release-9-0-9.html [3] http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by adding the (1) SECURITY DEFINER or (2) SET attributes to a procedural language's call handler.
An integer overflow flaw was found in the way postgresql used to calculate size for the hashtable for joined relations. An attacker could formulate a specially-crafted sql query, which once processed would lead to denial of service (postgresql daemon crash).
Upstream bug report: -------------------- [1] http://archives.postgresql.org/pgsql-bugs/2009-10/msg00277.php
References: ----------- [2] http://archives.postgresql.org/pgsql-bugs/2009-10/msg00287.php [3] http://archives.postgresql.org/pgsql-bugs/2009-10/msg00310.php [4] http://archives.postgresql.org/pgsql-bugs/2009-10/msg00289.php
Upstream patch: --------------- git clone git://git.postgresql.org/git/postgresql.git cd postgresql && git show 64b057e6823655fb6c5d1f24a28f236b94dd6c54
Credit: ------- Bernt Marius Johnsen