Rapid7 Vulnerability & Exploit Database

ELSA-2009-1485 Moderate: Enterprise Linux postgresql security update

Free InsightVM Trial No credit card necessary

Watch Demo See how it all works

Back to Search

ELSA-2009-1485 Moderate: Enterprise Linux postgresql security update

Severity

CVSS

(AV:N/AC:L/Au:S/C:P/I:P/A:P)

Published

09/17/2009

Created

07/25/2018

Added

12/20/2011

Modified

07/04/2017

Description

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.

Solution(s)

oracle-linux-upgrade-rh-postgresql
oracle-linux-upgrade-rh-postgresql-contrib
oracle-linux-upgrade-rh-postgresql-devel
oracle-linux-upgrade-rh-postgresql-docs
oracle-linux-upgrade-rh-postgresql-jdbc
oracle-linux-upgrade-rh-postgresql-libs
oracle-linux-upgrade-rh-postgresql-pl
oracle-linux-upgrade-rh-postgresql-python
oracle-linux-upgrade-rh-postgresql-server
oracle-linux-upgrade-rh-postgresql-tcl
oracle-linux-upgrade-rh-postgresql-test

References

https://attackerkb.com/topics/cve-2009-3230
36314
CVE - 2009-3230
DSA-1900
OVAL10166
http://oss.oracle.com/pipermail/el-errata/2009-October/001185.html

Advanced vulnerability management analytics and reporting.

Key Features

Free InsightVM Trial View All Features

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;