PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19,...
Vulnerability Description
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
Impact Analysis
Refer to official advisory for detailed impact metrics.
Remediation
Ensure systems are updated to the latest vendor-supplied patch levels.
Am I Vulnerable?
Launch our assessment wizard to check if your infrastructure is exposed to • CVE-2009-4136
Credits & Attribution
No credits recorded in the NVD database.
References
- http://www.redhat.com/support/errata/RHSA-2010-0427.html
- http://www.redhat.com/support/errata/RHSA-2010-0428.html
- http://marc.info/?l=bugtraq&m=134124585221119&w=2
- http://www.securitytracker.com/id?1023326
- http://secunia.com/advisories/39820
- http://www.postgresql.org/docs/current/static/release-8-2-15.html
- https://bugzilla.redhat.com/show_bug.cgi?id=546321
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01035.html
- http://www.postgresql.org/support/security.html
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9358
- http://www.postgresql.org/docs/current/static/release-8-4-2.html
- http://www.postgresql.org/docs/current/static/release-8-0-23.html
- http://www.securityfocus.com/archive/1/509917/100/0/threaded
- http://lists.opensuse.org/opensuse-security-announce/2010-01/msg00007.html
- http://www.postgresql.org/docs/current/static/release-8-3-9.html
- https://www.redhat.com/archives/fedora-package-announce/2009-December/msg01056.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2009:333
- http://www.postgresql.org/docs/current/static/release-7-4-27.html
- http://www.vupen.com/english/advisories/2009/3519
- http://osvdb.org/61039
- http://www.postgresql.org/docs/current/static/release-8-1-19.html
- http://secunia.com/advisories/37663
- http://www.securityfocus.com/bid/37333
- http://www.redhat.com/support/errata/RHSA-2010-0429.html
- http://marc.info/?l=bugtraq&m=134124585221119&w=2
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
- http://www.vupen.com/english/advisories/2010/1197
More from postgresql
View All →Affected Vendor
postgresql
View all reports →Affected Software
Timeline
CVSS Vectors
Weaknesses (CWE)
No CWE data available
MITRE ATT&CK TTPs
No associated TTPs found for this vulnerability.