1. Ubuntu Security Notices
  2. USN-876-1

USN-876-1: PostgreSQL vulnerabilities

Publication date

3 January 2010

Overview

PostgreSQL vulnerabilities

Releases

Packages

Details

It was discovered that PostgreSQL did not properly handle certificates with
NULL characters in the Common Name field of X.509 certificates. An attacker
could exploit this to perform a machine-in-the-middle attack to view sensitive
information or alter encrypted communications. (CVE-2009-4034)

It was discovered that PostgreSQL did not properly manage session-local
state. A remote authenticated user could exploit this to escalate
priviliges within PostgreSQL. (CVE-2009-4136)

It was discovered that PostgreSQL did not properly handle certificates with
NULL characters in the Common Name field of X.509 certificates. An attacker
could exploit this to perform a machine-in-the-middle attack to view sensitive
information or alter encrypted communications. (CVE-2009-4034)

It was discovered that PostgreSQL did not properly manage session-local
state. A remote authenticated user could exploit this to escalate
priviliges within PostgreSQL. (CVE-2009-4136)

Update instructions

In general, a standard system upgrade is sufficient to effect the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
9.10 karmic postgresql-8.4 –  8.4.2-0ubuntu9.10
9.04 jaunty postgresql-8.3 –  8.3.9-0ubuntu9.04
8.10 intrepid postgresql-8.3 –  8.3.9-0ubuntu8.10
8.04 hardy postgresql-8.3 –  8.3.9-0ubuntu8.04
6.06 dapper postgresql-8.1 –  8.1.19-0ubuntu0.6.06

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›