Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before...

Vulnerability Description

Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file corruption), and allows remote authenticated users to modify configuration settings and execute arbitrary code, via a connection request using a database name that begins with a "-" (hyphen).

References

• http://www.postgresql.org/docs/current/static/release-9-2-4.html
• http://www.postgresql.org/about/news/1456/
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html
• http://www.postgresql.org/support/security/faq/2013-04-04/
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:142
• http://support.apple.com/kb/HT5892
• http://www.postgresql.org/docs/current/static/release-9-0-13.html
• http://www.ubuntu.com/usn/USN-1789-1
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html
• http://www.postgresql.org/docs/current/static/release-9-1-9.html
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html
• http://www.debian.org/security/2013/dsa-2658
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html
• http://support.apple.com/kb/HT5880