Otkriveni su i otklonjeni višestruki sigurnosni propusti paketa postgresql. Napadač ih je mogao iskoristiti za proizvoljno čitanje i pisanje sistemskih datoteka, nedopušten pristup lozinkama, uskraćivanje usluga, dobivanje većih privilegija te ubacivanje SQL koda.
Paket:
PostgreSQL 9.x
Operacijski sustavi:
Fedora 17
Kritičnost:
6.5
Problem:
nepravilno rukovanje ovlastima, pogreška u programskoj funkciji, pogreška u programskoj komponenti
Problemi proizlaze iz xml2 contrib komponente koja nepravilno rukuje XML datotekama, xmlparse komponente za parsiranje XML datoteka, krivo razvijene funkcije crypt() za kriptiranje lozinki, zbog neispravnog rukovanja dodatkom za strane jezike, krivog provjeravanja SSL certifikata i pg_dump komponente za uzimanje informacija iz datoteka.
Posljedica:
Kao rezultat navedenih nedostataka napadač je mogao neovlašteno pristupiti osjetljivim informacijama, pisati i čitati sistemske datoteke, dovesti do uskraćivanja usluga, podmetnuti lažne certifikate te ubaciti SQL kod i dobiti veće privilegije.
Rješenje:
Svim korisnicima savjetuje se instalacija odgovarajućih zakrpa.
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-12165
2012-08-18 01:05:30
--------------------------------------------------------------------------------
Name : postgresql
Product : Fedora 17
Version : 9.1.5
Release : 1.fc17
URL : http://www.postgresql.org/
Summary : PostgreSQL client programs
Description :
PostgreSQL is an advanced Object-Relational database management system (DBMS).
The base postgresql package contains the client programs that you'll need to
access a PostgreSQL DBMS server, as well as HTML documentation for the whole
system. These client programs can be located on the same machine as the
PostgreSQL server, or on a remote machine that accesses a PostgreSQL server
over a network connection. The PostgreSQL server can be found in the
postgresql-server sub-package.
--------------------------------------------------------------------------------
Update Information:
Update to PostgreSQL 9.1.5, for various fixes described at
http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
including the fixes for CVE-2012-3488, CVE-2012-3489
Configure postmaster to create Unix-domain sockets in both /var/run/postgresql
and /tmp; the former is now the default place for libpq to contact the
postmaster. This works around problems with clients running in a PrivateTmp
context.
--------------------------------------------------------------------------------
ChangeLog:
* Fri Aug 17 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.5-1
- Update to PostgreSQL 9.1.5, for various fixes described at
http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
including the fixes for CVE-2012-3488, CVE-2012-3489
* Mon Aug 13 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.4-5
- Back-port upstream support for postmaster listening on multiple Unix sockets
- Configure postmaster to create sockets in both /var/run/postgresql and /tmp;
the former is now the default place for libpq to contact the postmaster.
Resolves: #825448
- Annotate postgresql.conf about not setting port number there
- Minor specfile cleanup per suggestions from Tom Callaway
Related: #845110
* Sat Jul 14 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.4-3
- Update code to use oom_score_adj not oom_adj, thereby suppressing
whining in the kernel log
- Add "legacy action" scripts to support "service postgresql initdb" and
"service postgresql upgrade" in a now-approved fashion (requires a
recent version of initscripts to work)
Resolves: #800416
* Mon Jun 4 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.4-1
- Update to PostgreSQL 9.1.4, for various fixes described at
http://www.postgresql.org/docs/9.1/static/release-9-1-4.html
including the fixes for CVE-2012-2143, CVE-2012-2655
Resolves: #826606
- Update previous version (embedded in postgresql-upgrade) to 9.0.8
because fix in whole-row variable dumping could be needed for upgrades
- Revert fix for bug #800416, per fedora-packaging discussion at
http://lists.fedoraproject.org/pipermail/packaging/2012-April/008314.html
"service postgresql initdb" is dead and will stay that way
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #849172 - CVE-2012-3488 postgresql (xml2 contrib module): XXE by
applying XSL stylesheet to the document
https://bugzilla.redhat.com/show_bug.cgi?id=849172
[ 2 ] Bug #849173 - CVE-2012-3489 postgresql: File disclosure through XXE in
xmlparse by DTD validation
https://bugzilla.redhat.com/show_bug.cgi?id=849173
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update postgresql' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
package-announce@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/package-announce
--------------------------------------------------------------------------------
Fedora Update Notification
FEDORA-2012-12156
2012-08-18 01:04:02
--------------------------------------------------------------------------------
Name : postgresql
Product : Fedora 16
Version : 9.1.5
Release : 1.fc16
URL : http://www.postgresql.org/
Summary : PostgreSQL client programs
Description :
PostgreSQL is an advanced Object-Relational database management system (DBMS).
The base postgresql package contains the client programs that you'll need to
access a PostgreSQL DBMS server, as well as HTML documentation for the whole
system. These client programs can be located on the same machine as the
PostgreSQL server, or on a remote machine that accesses a PostgreSQL server
over a network connection. The PostgreSQL server can be found in the
postgresql-server sub-package.
--------------------------------------------------------------------------------
Update Information:
Update to PostgreSQL 9.1.5, for various fixes described at
http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
including the fixes for CVE-2012-3488, CVE-2012-3489
--------------------------------------------------------------------------------
ChangeLog:
* Fri Aug 17 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.5-1
- Update to PostgreSQL 9.1.5, for various fixes described at
http://www.postgresql.org/docs/9.1/static/release-9-1-5.html
including the fixes for CVE-2012-3488, CVE-2012-3489
- Minor specfile cleanup per suggestions from Tom Callaway
Related: #845110
* Sat Jul 14 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.4-3
- Update code to use oom_score_adj not oom_adj, thereby suppressing
whining in the kernel log
- Add "legacy action" scripts to support "service postgresql initdb" and
"service postgresql upgrade" in a now-approved fashion (requires a
recent version of initscripts to work)
Resolves: #800416
* Mon Jun 4 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.4-1
- Update to PostgreSQL 9.1.4, for various fixes described at
http://www.postgresql.org/docs/9.1/static/release-9-1-4.html
including the fixes for CVE-2012-2143, CVE-2012-2655
Resolves: #826606
- Update previous version (embedded in postgresql-upgrade) to 9.0.8
because fix in whole-row variable dumping could be needed for upgrades
- Revert fix for bug #800416, per fedora-packaging discussion at
http://lists.fedoraproject.org/pipermail/packaging/2012-April/008314.html
"service postgresql initdb" is dead and will stay that way
* Sat Mar 17 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.3-3
- Fix postgresql-setup to rely on systemd to parse the unit file, instead
of using ad-hoc code
Resolves: #804290
* Tue Mar 13 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.3-2
- Fix postgresql-setup to look for unit file in /usr/lib and to ignore
comments therein
Resolves: #802835
- Resurrect a now-mostly-dummy postgresql init script, so that people can
keep on using "service postgresql initdb" if they wish
Resolves: #800416
* Mon Feb 27 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.3-1
- Update to PostgreSQL 9.1.3, for various fixes described at
http://www.postgresql.org/docs/9.1/static/release-9-1-3.html
including the fixes for CVE-2012-0866, CVE-2012-0867, CVE-2012-0868
Resolves: #797918
* Mon Jan 9 2012 Tom Lane <tgl@xxxxxxxxxx> 9.1.2-2
- Make systemd unit file more user-friendly by resurrecting the old init
script's checks for data directory presence and version match
Resolves: #771496
* Mon Dec 5 2011 Tom Lane <tgl@xxxxxxxxxx> 9.1.2-1
- Update to PostgreSQL 9.1.2, for various fixes described at
http://www.postgresql.org/docs/9.1/static/release-9-1-2.html
* Wed Nov 2 2011 Honza Horak <hhorak@xxxxxxxxxx> 9.1.1-2
- Create a symlink of pg_regress instead of full copy;
Don't strip symbols from regress libs
Related: #729012
--------------------------------------------------------------------------------
References:
[ 1 ] Bug #849172 - CVE-2012-3488 postgresql (xml2 contrib module): XXE by
applying XSL stylesheet to the document
https://bugzilla.redhat.com/show_bug.cgi?id=849172
[ 2 ] Bug #849173 - CVE-2012-3489 postgresql: File disclosure through XXE in
xmlparse by DTD validation
https://bugzilla.redhat.com/show_bug.cgi?id=849173
--------------------------------------------------------------------------------
This update can be installed with the "yum" update program. Use
su -c 'yum update postgresql' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.
All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
https://fedoraproject.org/keys
--------------------------------------------------------------------------------
_______________________________________________
package-announce mailing list
package-announce@xxxxxxxxxxxxxxxxxxxxxxx
https://admin.fedoraproject.org/mailman/listinfo/package-announce
Posljednje sigurnosne preporuke