Bug 522092 (CVE-2009-3229) - CVE-2009-3229 postgresql: authenticated user server DoS via plugin re-LOAD-ing
Summary: CVE-2009-3229 postgresql: authenticated user server DoS via plugin re-LOAD-ing
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2009-3229
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard: impact=low,source=internet,reported=2...
Depends On: 522223
Blocks:
TreeView+ depends on / blocked
 
Reported: 2009-09-09 13:19 UTC by Tomas Hoger
Modified: 2019-06-08 12:49 UTC (History)
5 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Environment:
Last Closed: 2010-03-29 10:02:51 UTC


Attachments (Terms of Use)


Links
System ID Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2009:1461 normal SHIPPED_LIVE Important: Red Hat Application Stack v2.4 security and enhancement update 2009-09-23 21:38:40 UTC

Description Tomas Hoger 2009-09-09 13:19:53 UTC
Quoting upstream PostgreSQL security page:
  http://www.postgresql.org/support/security.html

  Authenticated non-superusers can shut down the backend server by
  re-LOAD-ing libraries in $libdir/plugins, if any libraries are present
  there.

Affected versions: 8.4, 8.3, 8.2

Fixed in versions: 8.4.1, 8.3.8, 8.2.14

Severity: D - A vulnerability that is exploitable for denial-of-service, but requiring a valid prior login.

Comment 1 Fedora Update System 2009-09-09 18:14:58 UTC
postgresql-8.3.8-1.fc11 has been submitted as an update for Fedora 11.
http://admin.fedoraproject.org/updates/postgresql-8.3.8-1.fc11

Comment 2 Fedora Update System 2009-09-09 18:15:12 UTC
postgresql-8.3.8-1.fc10 has been submitted as an update for Fedora 10.
http://admin.fedoraproject.org/updates/postgresql-8.3.8-1.fc10

Comment 4 Vincent Danen 2009-09-10 03:14:53 UTC
The Red Hat Security Response Team has rated this issue as having low security impact; a future update may address this flaw.

The LOAD support in PostgreSQL changed in version 8.2 where non-superuser users can use LOAD to load modules in the plugins subdirectory (prior to 8.2 this feature was only available to superusers).  As a result, if a plugin causes a crash in pre-8.2 versions, it was not considered a security hole since only the database administrator could cause the crash, not just any user.

This also only causes a momentary denial of service during crash recovery.  As well, Red Hat does not ship any plugins by default.

Comment 5 Fedora Update System 2009-09-11 23:21:08 UTC
postgresql-8.3.8-1.fc11 has been pushed to the Fedora 11 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 6 Fedora Update System 2009-09-11 23:21:41 UTC
postgresql-8.3.8-1.fc10 has been pushed to the Fedora 10 stable repository.  If problems still persist, please make note of it in this bug report.

Comment 7 Jan Lieskovsky 2009-09-17 08:26:33 UTC
MITRE's CVE-2009-3229 record:
-----------------------------
The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before
8.3.8, and 8.2 before 8.2.14 allows remote authenticated users to
cause a denial of service (backend shutdown) by "re-LOAD-ing"
libraries from a certain plugins directory.

References:
-----------
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-3229
http://www.postgresql.org/docs/8.3/static/release-8-3-8.html
http://www.postgresql.org/support/security.html
https://bugzilla.redhat.com/show_bug.cgi?id=522092
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html
http://www.securityfocus.com/bid/36314
http://secunia.com/advisories/36660
http://secunia.com/advisories/36727

Comment 8 errata-xmlrpc 2009-09-23 21:38:56 UTC
This issue has been addressed in following products:

  Red Hat Web Application Stack for RHEL 5

Via RHSA-2009:1461 https://rhn.redhat.com/errata/RHSA-2009-1461.html


Note You need to log in before you can comment on or make changes to this bug.