1. Ubuntu Security Notices
  2. USN-942-1

USN-942-1: PostgreSQL vulnerabilities

Publication date

21 May 2010

Overview

If PostgreSQL was configured to use Perl and/or Tcl stored procedures a remote authenticated attacker could run programs as the database user.

Releases

Packages

Details

It was discovered that the Safe.pm module as used by PostgreSQL did not
properly restrict PL/perl procedures. If PostgreSQL was configured to use
Perl stored procedures, a remote authenticated attacker could exploit this
to execute arbitrary Perl code. (CVE-2010-1169)

It was discovered that PostgreSQL did not properly check permissions to
restrict PL/Tcl procedures. If PostgreSQL was configured to use Tcl stored
procedures, a remote authenticated attacker could exploit this to execute
arbitrary Tcl code. (CVE-2010-1170)

It was discovered that PostgreSQL did not properly check privileges during
certain RESET ALL operations. A remote authenticated attacker could exploit
this to remove all special parameter settings for a user or database.
(CVE-2010-1975)

It was discovered that the Safe.pm module as used by PostgreSQL did not
properly restrict PL/perl procedures. If PostgreSQL was configured to use
Perl stored procedures, a remote authenticated attacker could exploit this
to execute arbitrary Perl code. (CVE-2010-1169)

It was discovered that PostgreSQL did not properly check permissions to
restrict PL/Tcl procedures. If PostgreSQL was configured to use Tcl stored
procedures, a remote authenticated attacker could exploit this to execute
arbitrary Tcl code. (CVE-2010-1170)

It was discovered that PostgreSQL did not properly check privileges during
certain RESET ALL operations. A remote authenticated attacker could exploit
this to remove all special parameter settings for a user or database.
(CVE-2010-1975)

Update instructions

This update uses a new upstream release, which includes additional bug fixes. In general, a standard system update will make all the necessary changes.

Learn more about how to get the fixes.

The problem can be corrected by updating your system to the following package versions:

Ubuntu Release Package Version
9.10 karmic postgresql-pltcl-8.4 –  8.4.4-0ubuntu9.10
postgresql-plperl-8.4 –  8.4.4-0ubuntu9.10
9.04 jaunty postgresql-plperl-8.3 –  8.3.11-0ubuntu9.04
postgresql-pltcl-8.3 –  8.3.11-0ubuntu9.04
8.04 hardy postgresql-plperl-8.3 –  8.3.11-0ubuntu8.04
postgresql-pltcl-8.3 –  8.3.11-0ubuntu8.04
6.06 dapper postgresql-plperl-8.1 –  8.1.21-0ubuntu0.6.06
postgresql-pltcl-8.1 –  8.1.21-0ubuntu0.6.06
10.04 lucid postgresql-pltcl-8.4 –  8.4.4-0ubuntu10.04
postgresql-plperl-8.4 –  8.4.4-0ubuntu10.04

Reduce your security exposure

Ubuntu Pro provides ten-year security coverage to 25,000+ packages in Main and Universe repositories, and it is free for up to five machines.

Get Ubuntu Pro

References

Have additional questions?

Talk to a member of the team ›