Otklonjena su dva sigurnosna nedostatka u radu programskog paketa postgresql8.3. Udaljeni ih napadači mogu iskoristiti za umetanje SQL naredbi i zaobilaženje postavljenih ograničenja.
Paket:
PostgreSQL 8.x
Operacijski sustavi:
Mandriva Linux Enterprise Server 5.0
Kritičnost:
5
Problem:
neodgovarajuća provjera ulaznih podataka, pogreška u programskoj komponenti
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDVSA-2012:027
http://www.mandriva.com/security/
_______________________________________________________________________
Package : postgresql8.3
Date : February 29, 2012
Affected: Enterprise Server 5.0
_______________________________________________________________________
Problem Description:
Multiple vulnerabilities has been discovered and corrected in
postgresql:
Permissions on a function called by a trigger are not properly checked
(CVE-2012-0866).
Line breaks in object names can be exploited to execute arbitrary
SQL when reloading a pg_dump file (CVE-2012-0868).
This advisory provides the latest version of PostgreSQL that is not
vulnerable to these issues.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0866
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-0868
http://www.postgresql.org/docs/8.3/static/release-8-3-18.html
_______________________________________________________________________
Updated Packages:
Mandriva Enterprise Server 5:
70516f4a8393dc8e20def2f1a2462221
mes5/i586/libecpg8.3_6-8.3.18-0.1mdvmes5.2.i586.rpm
1348530066e2c20f69fb20597016cd59
mes5/i586/libpq8.3_5-8.3.18-0.1mdvmes5.2.i586.rpm
2913c5253b14ee9693a56de326aef908
mes5/i586/postgresql8.3-8.3.18-0.1mdvmes5.2.i586.rpm
def833bca0e5b4f5ecfefb9b8ac7c70e
mes5/i586/postgresql8.3-contrib-8.3.18-0.1mdvmes5.2.i586.rpm
b43a09ab67757ba151aa00070c48657f
mes5/i586/postgresql8.3-devel-8.3.18-0.1mdvmes5.2.i586.rpm
5ca9f707e5949501f4e83244d191312a
mes5/i586/postgresql8.3-docs-8.3.18-0.1mdvmes5.2.i586.rpm
b6eaded77ff8cafb2908b28ce16cd53f
mes5/i586/postgresql8.3-pl-8.3.18-0.1mdvmes5.2.i586.rpm
4aac998ffd953e60e670c9bf5655919e
mes5/i586/postgresql8.3-plperl-8.3.18-0.1mdvmes5.2.i586.rpm
f72237aa1bc703a5ac388d6a868994ce
mes5/i586/postgresql8.3-plpgsql-8.3.18-0.1mdvmes5.2.i586.rpm
b574999678236b55ff63c9d1bd187fd1
mes5/i586/postgresql8.3-plpython-8.3.18-0.1mdvmes5.2.i586.rpm
61cca3e61d15c51c81d10018145d87e4
mes5/i586/postgresql8.3-pltcl-8.3.18-0.1mdvmes5.2.i586.rpm
841d4c560acd2f3124506a2dda11f61a
mes5/i586/postgresql8.3-server-8.3.18-0.1mdvmes5.2.i586.rpm
e2eb79399056d7bd7fe4cac74dd39b5b
mes5/SRPMS/postgresql8.3-8.3.18-0.1mdvmes5.2.src.rpm
Mandriva Enterprise Server 5/X86_64:
b9218c66711faa5fe9d0f2a75a56f641
mes5/x86_64/lib64ecpg8.3_6-8.3.18-0.1mdvmes5.2.x86_64.rpm
ea479cdd2007427c84e83e8b7c76edac
mes5/x86_64/lib64pq8.3_5-8.3.18-0.1mdvmes5.2.x86_64.rpm
609ef28cc049852b270a47b0c28b5b4e
mes5/x86_64/postgresql8.3-8.3.18-0.1mdvmes5.2.x86_64.rpm
82a498d8e4d685aede175f6adde68dd8
mes5/x86_64/postgresql8.3-contrib-8.3.18-0.1mdvmes5.2.x86_64.rpm
c5c9e0960552b750973d7ed6b8d66c80
mes5/x86_64/postgresql8.3-devel-8.3.18-0.1mdvmes5.2.x86_64.rpm
20fd300c66cca64191b8565b97341c3e
mes5/x86_64/postgresql8.3-docs-8.3.18-0.1mdvmes5.2.x86_64.rpm
a267c66e17c77f7ae0f970cd6675116b
mes5/x86_64/postgresql8.3-pl-8.3.18-0.1mdvmes5.2.x86_64.rpm
11eb9ebb0342cf0106b90c6e0320ce16
mes5/x86_64/postgresql8.3-plperl-8.3.18-0.1mdvmes5.2.x86_64.rpm
d4cbc6c7bb58c11accbfc2f0c62119d3
mes5/x86_64/postgresql8.3-plpgsql-8.3.18-0.1mdvmes5.2.x86_64.rpm
06b523e852e2b9938d39ead100f85aa9
mes5/x86_64/postgresql8.3-plpython-8.3.18-0.1mdvmes5.2.x86_64.rpm
412ae74a1291b6a4684115c0bf351557
mes5/x86_64/postgresql8.3-pltcl-8.3.18-0.1mdvmes5.2.x86_64.rpm
ec6945403a50732a1823d1fa6974735c
mes5/x86_64/postgresql8.3-server-8.3.18-0.1mdvmes5.2.x86_64.rpm
e2eb79399056d7bd7fe4cac74dd39b5b
mes5/SRPMS/postgresql8.3-8.3.18-0.1mdvmes5.2.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.11 (GNU/Linux)
iD8DBQFPTh//mqjQ0CJFipgRAkt4AJ9SwW7Gd5Nyo1Te18e4WgLuQTNpIwCfQ48u
XyLPCKk0rQ5LHeqlZSRbHuA=
=9MPa
-----END PGP SIGNATURE-----
Posljednje sigurnosne preporuke