Bug 1188688 (CVE-2015-0242)

Summary: CVE-2015-0242 postgresql: buffer overflow flaws in replacement *printf() functions
Product: [Other] Security Response Reporter: Martin Prpič <mprpic>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED NOTABUG QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: apatters, cperry, dajohnso, dclarizi, gmccullo, hannsj_uhl, jhardy, jmlich, jorton, jprause, jrafanie, jvlcek, kseifried, mkollar, mmaslano, obarenbo, praiskup, security-response-team, taw, tjay, vkaigoro, xlecauch
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: postgresql 9.0.19, postgresql 9.1.15, postgresql 9.2.10, postgresql 9.3.6, postgresql 9.4.1 Doc Type: Bug Fix
Doc Text:
A buffer overflow flaw was found in the PostgreSQL's internal printf() implementation. An authenticated database user could use a specially crafted string in an SQL query to cause PostgreSQL to crash or, potentially, lead to privilege escalation.
 Story Points: ---
Clone Of: Environment:
Last Closed: 2015-02-16 07:54:25 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On:    
Bug Blocks: 1188677    

Description Martin Prpič 2015-02-03 14:26:29 UTC 
The PostgreSQL project reports the following issue:

PostgreSQL includes a replacement implementation of printf and related functions. This code will overrun a stack buffer when formatting a floating point number (conversion specifiers e, E, f, F, g or G) with requested precision greater than about 500. This will crash the server, and we have not ruled out the possibility of attacks that lead to privilege escalation. A database user can trigger such a buffer overrun through the to_char() SQL function. While that is the only affected core PostgreSQL functionality, extension modules that use printf-family functions may be at risk as well.

This issue primarily affects PostgreSQL on Windows. PostgreSQL uses the system implementation of these functions where adequate, which it is on other modern platforms.

Acknowledgements:

Red Hat would like to thank the PostgreSQL project for reporting this issue. Upstream acknowledges Bruce Momjian as the original reporter.
Comment 1 Huzaifa S. Sidhpurwala 2015-02-16 05:17:11 UTC 
External References:

http://www.postgresql.org/about/news/1569/
Comment 2 Huzaifa S. Sidhpurwala 2015-02-16 06:18:52 UTC 
Upstream patch:

https://github.com/postgres/postgres/commit/29725b3db67ad3f09da1a7fb6690737d2f8d6c0a
Comment 3 Huzaifa S. Sidhpurwala 2015-02-16 06:52:44 UTC 
This issue was addressed in Fedora 20 and Fedora 21 via the following security advisories:

https://admin.fedoraproject.org/updates/FEDORA-2015-1728/postgresql-9.3.6-1.fc20
https://admin.fedoraproject.org/updates/FEDORA-2015-1745/postgresql-9.3.6-1.fc21
Comment 5 Vasyl Kaigorodov 2015-03-12 15:36:18 UTC 
Statement:

Not vulnerable. This issue does not affect the version of the postgresql package shipped in Red Hat Enterprise Linux 5, 6, and 7 because it does not use the vulnerable implementation of the snprintf() function provided by postgresql; the glibc implementation of this function, which is not vulnerable to this issue, is used instead.