CVE-2009-4136
MEDIUM severity · CVSS 6.5
6.5CVSS MEDIUM
Summary
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
Impact & exploitability
Attack vectorNetwork
Attack complexityLow
Privileges required—
User interaction—
Confidentiality impact—
Integrity impact—
Availability impact—
Exploit probability (EPSS)4%
AV:N/AC:L/Au:S/C:P/I:P/A:P
Affected products we track (1)
Recommendation
Apply the vendor fix in your normal patch cycle. Open any affected product above for its exact safe version.
Official patch: http://www.postgresql.org/docs/current/static/release-7-4-27.html ↗
Additional information
- NVD record
- http://www.postgresql.org/docs/current/static/release-7-4-27.htmlPatch
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html
- http://marc.info/?l=bugtraq&m=134124585221119&w=2
- http://osvdb.org/61039
- http://secunia.com/advisories/37663
- http://secunia.com/advisories/39820
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:333