Bug 237680

Summary:	CVE-2007-2138 PostgreSQL security-definer function privilege escalation
Product:	Red Hat Enterprise Linux 5	Reporter:	Josh Bressers <bressers>
Component:	postgresql	Assignee:	Tom Lane <tgl>
Status:	CLOSED ERRATA	QA Contact:	David Lawrence <dkl>
Severity:	medium	Docs Contact:
Priority:	medium
Version:	5.0	CC:	hhorak, lkundrak
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:	impact=moderate,public=20070423,reported=20070419,source=redhat
Fixed In Version:	RHSA-2007-0336	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2007-05-08 15:38:49 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Josh Bressers 2007-04-24 18:39:01 UTC

Quoting the PostgreSQL release notes:
http://www.postgresql.org/docs/8.2/static/release-8-2-4.html

    Support explicit placement of the temporary-table schema within search_path, 
    and disable searching it for functions and operators (Tom)

    This is needed to allow a security-definer function to set a truly secure 
    value of search_path. Without it, an unprivileged SQL user can use temporary 
    objects to execute code with the privileges of the security-definer function 
    (CVE-2007-2138). See CREATE FUNCTION for more information.

This flaw also affects RHEL 3 and 4

Comment 1 Tom Lane 2007-04-24 21:58:18 UTC

I've built the following:
RHEL5  postgresql-8.1.9-1.el5
RHEL4  postgresql-7.4.17-1.RHEL4.1
RHEL3  rh-postgresql-7.3.19-1

but just now realized that they all went into qu dists not async ...
hope that's not a problem.

Comment 2 Lubomir Kundrak 2007-04-25 15:32:13 UTC

*** Bug 237823 has been marked as a duplicate of this bug. ***

Comment 6 Tom Lane 2007-04-26 19:52:46 UTC

Yeah, I know what it's for; I was wondering if it was intentional that rpmdiff
is now making this check in pre-RHEL5 branches, when it never did before.  I
asked on os-devel-list and didn't get a clear answer.  Anyway jakub did agree
that a security update isn't the time to be trying to fix such things.  I've
waived it since it's not a regression.

Comment 9 Red Hat Bugzilla 2007-05-08 15:38:49 UTC

An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on the solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHSA-2007-0336.html