USN-2120-1: PostgreSQL vulnerabilities

24 February 2014

postgresql-8.4, postgresql-9.1 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 13.10
  • Ubuntu 12.10
  • Ubuntu 12.04 LTS
  • Ubuntu 10.04 LTS

Summary

Several security issues were fixed in PostgreSQL.

Software Description

  • postgresql-9.1 - Object-relational SQL database
  • postgresql-8.4 - Object-relational SQL database

Details

Noah Misch and Jonas Sundman discovered that PostgreSQL did not correctly enforce ADMIN OPTION restrictions. An authenticated attacker could use this issue to possibly revoke access from others, contrary to expected permissions. (CVE-2014-0060)

Andres Freund discovered that PostgreSQL incorrectly handled validator functions. An authenticated attacker could possibly use this issue to escalate their privileges. (CVE-2014-0061)

Andres Freund discovered that PostgreSQL incorrectly handled concurrent CREATE INDEX statements. An authenticated attacker could possibly use this issue to obtain access to restricted data, bypassing intended privileges. (CVE-2014-0062)

Daniel Schüssler discovered that PostgreSQL incorrectly handled datetime input. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-0063)

It was discovered that PostgreSQL incorrectly handled certain size calculations. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-0064)

Peter Eisentraut and Jozef Mlich discovered that PostgreSQL incorrectly handled certain buffer sizes. An authenticated attacker could possibly use this issue to cause PostgreSQL to crash, resulting in a denial of service, or possibly execute arbitrary code. (CVE-2014-0065)

Honza Horak discovered that PostgreSQL incorrectly used the crypt() library function. This issue could possibly cause PostgreSQL to crash, resulting in a denial of service (CVE-2014-0066)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 13.10
postgresql-9.1 - 9.1.12-0ubuntu0.13.10
Ubuntu 12.10
postgresql-9.1 - 9.1.12-0ubuntu0.12.10
Ubuntu 12.04 LTS
postgresql-9.1 - 9.1.12-0ubuntu0.12.04
Ubuntu 10.04 LTS
postgresql-8.4 - 8.4.20-0ubuntu010.04

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes.

References