USN-942-1: PostgreSQL vulnerabilities

21 May 2010

postgresql-8.1, postgresql-8.3, postgresql-8.4 vulnerabilities

A security issue affects these releases of Ubuntu and its derivatives:

  • Ubuntu 10.04 LTS
  • Ubuntu 9.10
  • Ubuntu 9.04
  • Ubuntu 8.04 LTS
  • Ubuntu 6.06 LTS

Summary

If PostgreSQL was configured to use Perl and/or Tcl stored procedures a remote authenticated attacker could run programs as the database user.

Software Description

  • postgresql-8.4 - object-relational SQL database, version 8.4 server
  • postgresql-8.3 - object-relational SQL database, version 8.3 server
  • postgresql-8.1 - object-relational SQL database, version 8.1 server

Details

It was discovered that the Safe.pm module as used by PostgreSQL did not properly restrict PL/perl procedures. If PostgreSQL was configured to use Perl stored procedures, a remote authenticated attacker could exploit this to execute arbitrary Perl code. (CVE-2010-1169)

It was discovered that PostgreSQL did not properly check permissions to restrict PL/Tcl procedures. If PostgreSQL was configured to use Tcl stored procedures, a remote authenticated attacker could exploit this to execute arbitrary Tcl code. (CVE-2010-1170)

It was discovered that PostgreSQL did not properly check privileges during certain RESET ALL operations. A remote authenticated attacker could exploit this to remove all special parameter settings for a user or database. (CVE-2010-1975)

Update instructions

The problem can be corrected by updating your system to the following package versions:

Ubuntu 10.04 LTS
postgresql-plperl-8.4 - 8.4.4-0ubuntu10.04
postgresql-pltcl-8.4 - 8.4.4-0ubuntu10.04
Ubuntu 9.10
postgresql-plperl-8.4 - 8.4.4-0ubuntu9.10
postgresql-pltcl-8.4 - 8.4.4-0ubuntu9.10
Ubuntu 9.04
postgresql-plperl-8.3 - 8.3.11-0ubuntu9.04
postgresql-pltcl-8.3 - 8.3.11-0ubuntu9.04
Ubuntu 8.04 LTS
postgresql-plperl-8.3 - 8.3.11-0ubuntu8.04
postgresql-pltcl-8.3 - 8.3.11-0ubuntu8.04
Ubuntu 6.06 LTS
postgresql-plperl-8.1 - 8.1.21-0ubuntu0.6.06
postgresql-pltcl-8.1 - 8.1.21-0ubuntu0.6.06

To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.

This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes.

References