A flaw was found in the way PostgreSQL handled SQL functions, created
with SECURITY DEFINER keyword and implemented in PL/Perl or PL/Tcl
languages. Once the PL/Perl or PL/Tcl procedural language was registered
on particular database, a remote, authenticated user, running a
specially-crafted PL/Perl or PL/Tcl script could use this flaw to bypass
intended PostgreSQL SECURITY DEFINER function definition refinement /
protection mechanism, allowing them to run particular PostgreSQL function
under their effective user ID, potentially leading to escalation of their
privileges.
References:
[1] http://www.postgresql.org/docs/8.1/interactive/plperl.html
[2] http://www.postgresql.org/docs/8.1/static/pltcl.html
[3] http://www.postgresql.org/docs/8.1/interactive/sql-createfunction.html