{"id": "CVE-2002-1398", "bulletinFamily": "NVD", "title": "CVE-2002-1398", "description": "Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability \"in handling long datetime input.\"", "published": "2003-01-17T00:00:00", "modified": "2016-10-17T22:26:50", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-1398", "reporter": "NVD", "references": ["http://marc.info/?l=bugtraq&m=102996089613404&w=2", "http://marc.info/?l=bugtraq&m=102978152712430&w=2", "http://archives.postgresql.org/pgsql-announce/2002-08/msg00004.php", "http://www.redhat.com/support/errata/RHSA-2003-001.html", "http://marc.info/?l=postgresql-announce&m=103062536330644", "http://marc.info/?l=bugtraq&m=103021186622725&w=2", "http://www.debian.org/security/2002/dsa-165", "http://marc.info/?l=bugtraq&m=103036987114437&w=2", "http://www.novell.com/linux/security/advisories/2002_038_postgresql.html"], "cvelist": ["CVE-2002-1398"], "type": "cve", "lastseen": "2017-04-18T15:49:50", "history": [{"bulletin": {"assessment": {"href": "", "name": "", "system": ""}, "bulletinFamily": "NVD", "cpe": ["cpe:/a:postgresql:postgresql:7.2.1", "cpe:/a:postgresql:postgresql:7.1.2", "cpe:/a:postgresql:postgresql:7.1.1", "cpe:/a:postgresql:postgresql:6.5.3", "cpe:/a:postgresql:postgresql:7.1", "cpe:/a:postgresql:postgresql:6.3.2", "cpe:/a:postgresql:postgresql:7.1.3", "cpe:/a:postgresql:postgresql:7.2", "cpe:/a:postgresql:postgresql:7.0.3"], "cvelist": ["CVE-2002-1398"], "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}, "description": "Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, aka a vulnerability \"in handling long datetime input.\"", "edition": 1, "hash": "1be1aea717f75528ea3d269ecc492aafb6e11afdfa6e4c3ac3f9fc6215c894c6", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "scanner"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "reporter"}, {"hash": "277a851464dacd30fd04f8f01e583577", "key": "cpe"}, {"hash": "56765472680401499c79732468ba4340", "key": "objectVersion"}, {"hash": "6d3f4796275bb54c21a33b82f399cc6d", "key": "assessment"}, {"hash": "b49e5b3d1605094a3def397a0626e428", "key": "description"}, {"hash": "a70e2c4e62005caacf32151866c8632e", "key": "href"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "aa392583a5873cdbc2ed00a4152c8638", "key": "published"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "05d3d11e8bb846b2038ac440ef7245fc", "key": "title"}, {"hash": "292f2e293571b0e70e3182b615982dad", "key": "cvss"}, {"hash": "e885e613cf7b287187d0b1bd2dcfaa47", "key": "cvelist"}, {"hash": "6e3051d9153a3874e657b5c5ae59126e", "key": "references"}, {"hash": "9a6aa3016440cede80f315344d47ebd7", "key": "modified"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2002-1398", "id": "CVE-2002-1398", "lastseen": "2016-09-03T03:36:28", "modified": "2008-09-10T15:14:30", "objectVersion": "1.2", "published": "2003-01-17T00:00:00", "references": ["http://marc.theaimsgroup.com/?l=bugtraq&m=103036987114437&w=2", "http://marc.theaimsgroup.com/?l=bugtraq&m=103021186622725&w=2", "http://archives.postgresql.org/pgsql-announce/2002-08/msg00004.php", "http://www.redhat.com/support/errata/RHSA-2003-001.html", "http://marc.theaimsgroup.com/?l=bugtraq&m=102996089613404&w=2", "http://marc.theaimsgroup.com/?l=bugtraq&m=102978152712430&w=2", "http://www.debian.org/security/2002/dsa-165", "http://marc.theaimsgroup.com/?l=postgresql-announce&m=103062536330644", "http://www.novell.com/linux/security/advisories/2002_038_postgresql.html"], "reporter": "NVD", "scanner": [], "title": "CVE-2002-1398", "type": "cve", "viewCount": 0}, "differentElements": ["references", "modified"], "edition": 1, "lastseen": "2016-09-03T03:36:28"}], "edition": 2, "hashmap": [{"key": "assessment", "hash": "6d3f4796275bb54c21a33b82f399cc6d"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "277a851464dacd30fd04f8f01e583577"}, {"key": "cvelist", "hash": "e885e613cf7b287187d0b1bd2dcfaa47"}, {"key": "cvss", "hash": "292f2e293571b0e70e3182b615982dad"}, {"key": "description", "hash": "b49e5b3d1605094a3def397a0626e428"}, {"key": "href", "hash": "a70e2c4e62005caacf32151866c8632e"}, {"key": "modified", "hash": "c81dbbbda57090e750576e16171584de"}, {"key": "objectVersion", "hash": "56765472680401499c79732468ba4340"}, {"key": "published", "hash": "aa392583a5873cdbc2ed00a4152c8638"}, {"key": "references", "hash": "6f8ff51fd6e4d798c435688bd6ab9150"}, {"key": "reporter", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "scanner", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "title", "hash": "05d3d11e8bb846b2038ac440ef7245fc"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "5d5f0427b8ef65275d22df8e6d7aedbb4e128d4c870a4eab6c1a47c564c5a6df", "viewCount": 0, "objectVersion": "1.2", "cpe": ["cpe:/a:postgresql:postgresql:7.2.1", "cpe:/a:postgresql:postgresql:7.1.2", "cpe:/a:postgresql:postgresql:7.1.1", "cpe:/a:postgresql:postgresql:6.5.3", "cpe:/a:postgresql:postgresql:7.1", "cpe:/a:postgresql:postgresql:6.3.2", "cpe:/a:postgresql:postgresql:7.1.3", "cpe:/a:postgresql:postgresql:7.2", "cpe:/a:postgresql:postgresql:7.0.3"], "assessment": {"href": "", "name": "", "system": ""}, "scanner": [], "enchantments": {"score": {"value": 7.5, "vector": "NONE", "modified": "2017-04-18T15:49:50"}, "vulnersScore": 7.5}}

{"osvdb": [{"lastseen": "2017-04-28T13:20:01", "references": [], "edition": 1, "description": "## Vulnerability Description\nA local overflow exists in PostgreSQL. The date parser fails to validate input resulting in a buffer overflow. With a specially crafted request, an attacker can cause the database to crash resulting in a loss of availability.\n## Solution Description\nUpgrade to version 7.2.2 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.\n## Short Description\nA local overflow exists in PostgreSQL. The date parser fails to validate input resulting in a buffer overflow. With a specially crafted request, an attacker can cause the database to crash resulting in a loss of availability.\n## References:\nVendor URL: http://www.pgsql.com/\n[Vendor Specific Advisory URL](http://www.linuxsecurity.com/advisories/other_advisory-2309.html)\n[Vendor Specific Advisory URL](http://www.mandrakesecure.net/en/advisories/advisory.php?name=MDKSA-2002:062-1)\n[Vendor Specific Advisory URL](http://www.linuxsecurity.com/advisories/immunix_advisory-3150.html)\n[Vendor Specific Advisory URL](http://distro.conectiva.com/atualizacoes/?id=a&anuncio=000524)\n[Vendor Specific Advisory URL](ftp://ftp.freebsd.org/pub/FreeBSD/CERT/advisories/FreeBSD-SN-02:05.asc)\n[Vendor Specific Advisory URL](http://rhn.redhat.com/errata/RHSA-2003-010.html)\n[Vendor Specific Advisory URL](http://www.debian.org/security/2002/dsa-165)\n[Vendor Specific Advisory URL](http://rhn.redhat.com/errata/RHSA-2003-001.html)\nMail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=103021186622725&w=2\nMail List Post: http://marc.theaimsgroup.com/?l=bugtraq&m=102978152712430&w=2\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2002-08/0173.html\nMail List Post: http://archives.neohapsis.com/archives/bugtraq/2002-08/0258.html\nISS X-Force ID: 9892\n[CVE-2002-1398](https://vulners.com/cve/CVE-2002-1398)\nBugtraq ID: 6612\n", "reporter": "Sir Mordred(mordred@s-mail.com)", "published": "2002-08-19T00:00:00", "type": "osvdb", "title": "PostgreSQL Date Parser Overflow DoS", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "bulletinFamily": "software", "affectedSoftware": [{"name": "PostgreSQL", "version": "7.0.x", "operator": "eq"}, {"name": "PostgreSQL", "version": "6.x", "operator": "eq"}, {"name": "PostgreSQL", "version": "7.2", "operator": "eq"}, {"name": "PostgreSQL", "version": "7.1.x", "operator": "eq"}, {"name": "PostgreSQL", "version": "7.2.1", "operator": "eq"}], "cvelist": ["CVE-2002-1398"], "modified": "2002-08-19T00:00:00", "href": "https://vulners.com/osvdb/OSVDB:6190", "id": "OSVDB:6190", "cvss": {"score": 4.6, "vector": "AV:LOCAL/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "suse": [{"lastseen": "2016-09-04T11:56:36", "references": [], "affectedPackage": [{"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-devel", "packageFilename": "postgresql-devel-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql", "packageFilename": "postgresql-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-libs", "packageFilename": "postgresql-libs-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql", "packageFilename": "postgresql-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-test", "packageFilename": "postgresql-test-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-server", "packageFilename": "postgresql-server-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-lib", "packageFilename": "postgresql-lib-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-tcl", "packageFilename": "postgresql-tcl-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-python", "packageFilename": "postgresql-python-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-odbc", "packageFilename": "postgresql-odbc-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-tk", "packageFilename": "postgresql-tk-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-python", "packageFilename": "postgresql-python-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-perl", "packageFilename": "postgresql-perl-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-server", "packageFilename": "postgresql-server-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-docs", "packageFilename": "postgresql-docs-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-python", "packageFilename": "postgresql-python-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-devel", "packageFilename": "postgresql-devel-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-tcl", "packageFilename": "postgresql-tcl-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql", "packageFilename": "postgresql-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-tcl", "packageFilename": "postgresql-tcl-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-odbc", "packageFilename": "postgresql-odbc-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-jdbc", "packageFilename": "postgresql-jdbc-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-odbc", "packageFilename": "postgresql-odbc-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-devel", "packageFilename": "postgresql-devel-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-libs", "packageFilename": "postgresql-libs-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-contrib", "packageFilename": "postgresql-contrib-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-odbc", "packageFilename": "postgresql-odbc-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-perl", "packageFilename": "postgresql-perl-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-jdbc", "packageFilename": "postgresql-jdbc-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-test", "packageFilename": "postgresql-test-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-docs", "packageFilename": "postgresql-docs-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-perl", "packageFilename": "postgresql-perl-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-perl", "packageFilename": "postgresql-perl-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-contrib", "packageFilename": "postgresql-contrib-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-python", "packageFilename": "postgresql-python-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-contrib", "packageFilename": "postgresql-contrib-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-test", "packageFilename": "postgresql-test-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-devel", "packageFilename": "postgresql-devel-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-jdbc", "packageFilename": "postgresql-jdbc-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-jdbc", "packageFilename": "postgresql-jdbc-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-tk", "packageFilename": "postgresql-tk-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql", "packageFilename": "postgresql-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-tk", "packageFilename": "postgresql-tk-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-libs", "packageFilename": "postgresql-libs-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-server", "packageFilename": "postgresql-server-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-server", "packageFilename": "postgresql-server-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-95", "packageName": "postgresql-test", "packageFilename": "postgresql-test-7.1.3-95.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.1", "packageVersion": "7.0.3-23", "packageName": "postgresql-tcl", "packageFilename": "postgresql-tcl-7.0.3-23.ppc.rpm", "arch": "ppc", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "7.3", "packageVersion": "7.1.3-116", "packageName": "postgresql-tk", "packageFilename": "postgresql-tk-7.1.3-116.i386.rpm", "arch": "i386", "operator": "lt"}, {"OS": "openSUSE", "OSVersion": "8.0", "packageVersion": "7.2-103", "packageName": "postgresql-docs", "packageFilename": "postgresql-docs-7.2-103.i386.rpm", "arch": "i386", "operator": "lt"}], "description": "The PostgreSQL Object-Relational DBMS was found vulnerable to several security related buffer overflow problems. The buffer overflows are located in: * handling long datetime input * lpad() and rpad() function with multibyte * repeat() function * TZ and SET TIME ZONE environment variables These bugs could just be exploited by attackers who have access to the postgresql server to gain the privileges postgres user ID .", "edition": 1, "reporter": "Suse", "published": "2002-10-21T15:54:39", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "type": "suse", "title": "remote privilege escalation in postgresql", "bulletinFamily": "unix", "cvelist": ["CVE-2002-1398", "CVE-2002-1402", "CVE-2002-0972", "CVE-2002-1400"], "modified": "2002-10-21T15:54:39", "id": "SUSE-SA:2002:038", "href": "http://lists.opensuse.org/opensuse-security-announce/2002-10/msg00010.html", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "nessus": [{"lastseen": "2018-09-01T23:45:57", "references": ["http://online.securityfocus.com/archive/1/288334", "http://online.securityfocus.com/archive/1/288036", "http://archives.postgresql.org/pgsql-announce/2002-08/msg00004.php", "http://online.securityfocus.com/archive/1/288305"], "pluginID": "13963", "description": "Vulnerabilities were discovered in the Postgresql relational database by Mordred Labs. These vulnerabilities are buffer overflows in the rpad(), lpad(), repeat(), and cash_words() functions. The Postgresql developers also fixed a buffer overflow in functions that deal with time/date and timezone.\n\nFinally, more buffer overflows were discovered by Mordred Labs in the 7.2.2 release that are currently only fixed in CVS. These buffer overflows exist in the circle_poly(), path_encode(), and path_addr() functions.\n\nIn order for these vulnerabilities to be exploited, an attacker must be able to query the server somehow. However, this cannot directly lead to root privilege because the server runs as the postgresql user.\n\nPrior to upgrading, users should dump their database and retain it as backup. You can dump the database by using :\n\n$ pg_dumpall > db.out\n\nIf you need to restore from the backup, you can do so by using :\n\n$ psql -f db.out template1\n\nUpdate :\n\nThe previous update missed a few small fixes, including a buffer overflow in the cash_words() function that allows local users to cause a DoS and possibly execute arbitrary code via a malformed argument in Postgresql 7.2 and earlier. As well, buffer overflows in the TZ and SET TIME ZONE environment variables for Postgresql 7.2.1 and earlier can allow local users to cause a DoS and possibly execute arbitrary code.", "edition": 5, "reporter": "Tenable", "published": "2004-07-31T00:00:00", "title": "Mandrake Linux Security Advisory : postgresql (MDKSA-2002:062-1)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "naslFamily": "Mandriva Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2002-1398", "CVE-2002-1401", "CVE-2002-1402", "CVE-2002-0972", "CVE-2002-1397", "CVE-2002-1400"], "modified": "2018-07-19T00:00:00", "cpe": ["cpe:/o:mandrakesoft:mandrake_linux:7.2", "p-cpe:/a:mandriva:linux:postgresql-tcl", "p-cpe:/a:mandriva:linux:postgresql", "p-cpe:/a:mandriva:linux:libpgtcl2", "p-cpe:/a:mandriva:linux:postgresql-devel", "p-cpe:/a:mandriva:linux:libpgsql2", "p-cpe:/a:mandriva:linux:postgresql-docs", "cpe:/o:mandrakesoft:mandrake_linux:8.2", "p-cpe:/a:mandriva:linux:postgresql-test", "p-cpe:/a:mandriva:linux:postgresql-perl", "cpe:/o:mandrakesoft:mandrake_linux:8.0", "p-cpe:/a:mandriva:linux:postgresql-plperl", "p-cpe:/a:mandriva:linux:postgresql-odbc", "p-cpe:/a:mandriva:linux:postgresql-libs", "p-cpe:/a:mandriva:linux:postgresql-python", "p-cpe:/a:mandriva:linux:libpgsqlodbc0", "cpe:/o:mandrakesoft:mandrake_linux:9.0", "p-cpe:/a:mandriva:linux:libecpg3", "p-cpe:/a:mandriva:linux:postgresql-contrib", "cpe:/o:mandrakesoft:mandrake_linux:8.1", "p-cpe:/a:mandriva:linux:postgresql-jdbc", "p-cpe:/a:mandriva:linux:postgresql-tk", "p-cpe:/a:mandriva:linux:postgresql-server", "p-cpe:/a:mandriva:linux:libpgperl"], "id": "MANDRAKE_MDKSA-2002-062.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=13963", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Mandrake Linux Security Advisory MDKSA-2002:062. \n# The text itself is copyright (C) Mandriva S.A.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(13963);\n script_version (\"1.19\");\n script_cvs_date(\"Date: 2018/07/19 20:59:12\");\n\n script_cve_id(\"CVE-2002-0972\", \"CVE-2002-1397\", \"CVE-2002-1398\", \"CVE-2002-1400\", \"CVE-2002-1401\", \"CVE-2002-1402\");\n script_xref(name:\"MDKSA\", value:\"2002:062-1\");\n\n script_name(english:\"Mandrake Linux Security Advisory : postgresql (MDKSA-2002:062-1)\");\n script_summary(english:\"Checks rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\n\"The remote Mandrake Linux host is missing one or more security\nupdates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Vulnerabilities were discovered in the Postgresql relational database\nby Mordred Labs. These vulnerabilities are buffer overflows in the\nrpad(), lpad(), repeat(), and cash_words() functions. The Postgresql\ndevelopers also fixed a buffer overflow in functions that deal with\ntime/date and timezone.\n\nFinally, more buffer overflows were discovered by Mordred Labs in the\n7.2.2 release that are currently only fixed in CVS. These buffer\noverflows exist in the circle_poly(), path_encode(), and path_addr()\nfunctions.\n\nIn order for these vulnerabilities to be exploited, an attacker must\nbe able to query the server somehow. However, this cannot directly\nlead to root privilege because the server runs as the postgresql user.\n\nPrior to upgrading, users should dump their database and retain it as\nbackup. You can dump the database by using :\n\n$ pg_dumpall > db.out\n\nIf you need to restore from the backup, you can do so by using :\n\n$ psql -f db.out template1\n\nUpdate :\n\nThe previous update missed a few small fixes, including a buffer\noverflow in the cash_words() function that allows local users to cause\na DoS and possibly execute arbitrary code via a malformed argument in\nPostgresql 7.2 and earlier. As well, buffer overflows in the TZ and\nSET TIME ZONE environment variables for Postgresql 7.2.1 and earlier\ncan allow local users to cause a DoS and possibly execute arbitrary\ncode.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://archives.postgresql.org/pgsql-announce/2002-08/msg00004.php\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://online.securityfocus.com/archive/1/288036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://online.securityfocus.com/archive/1/288305\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://online.securityfocus.com/archive/1/288334\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libecpg3\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libpgperl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libpgsql2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libpgsqlodbc0\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:libpgtcl2\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-contrib\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-jdbc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-odbc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-plperl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-tcl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-test\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:mandriva:linux:postgresql-tk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:7.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:8.0\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:8.1\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:8.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:mandrakesoft:mandrake_linux:9.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2003/02/11\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2004/07/31\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Mandriva Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/cpu\", \"Host/Mandrake/release\", \"Host/Mandrake/rpm-list\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"rpm.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Mandrake/release\")) audit(AUDIT_OS_NOT, \"Mandriva / Mandake Linux\");\nif (!get_kb_item(\"Host/Mandrake/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (cpu !~ \"^(amd64|i[3-6]86|x86_64)$\") audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Mandriva / Mandrake Linux\", cpu);\n\n\nflag = 0;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-devel-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-jdbc-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-odbc-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-perl-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-python-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-server-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-tcl-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-test-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK7.2\", cpu:\"i386\", reference:\"postgresql-tk-7.0.2-6.2mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-devel-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-jdbc-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-odbc-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-perl-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-python-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-server-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-tcl-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-test-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.0\", cpu:\"i386\", reference:\"postgresql-tk-7.0.3-12.3mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-contrib-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-devel-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-docs-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-jdbc-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-libs-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-odbc-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-perl-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-plperl-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-python-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-server-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-tcl-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-test-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.1\", cpu:\"i386\", reference:\"postgresql-tk-7.1.2-19.3mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"libecpg3-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"libpgperl-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"libpgsql2-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"libpgsqlodbc0-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"libpgtcl2-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-contrib-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-devel-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-docs-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-jdbc-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-python-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-server-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-tcl-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-test-7.2-12.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK8.2\", cpu:\"i386\", reference:\"postgresql-tk-7.2-12.2mdk\", yank:\"mdk\")) flag++;\n\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"libecpg3-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"libpgperl-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"libpgsql2-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"libpgsqlodbc0-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"libpgtcl2-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-contrib-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-devel-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-docs-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-jdbc-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-python-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-server-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-tcl-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-test-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\nif (rpm_check(release:\"MDK9.0\", cpu:\"i386\", reference:\"postgresql-tk-7.2.2-1.2mdk\", yank:\"mdk\")) flag++;\n\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:rpm_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:54:45", "references": ["http://www.debian.org/security/2002/dsa-165"], "pluginID": "15002", "description": "Mordred Labs and others found several vulnerabilities in PostgreSQL, an object-relational SQL database. They are inherited from several buffer overflows and integer overflows. Specially crafted long date and time input, currency, repeat data and long timezone names could cause the PostgreSQL server to crash as well as specially crafted input data for lpad() and rpad(). More buffer/integer overflows were found in circle_poly(), path_encode() and path_addr().\n\nExcept for the last three, these problems are fixed in the upstream release 7.2.2 of PostgreSQL which is the recommended version to use.\n\nMost of these problems do not exist in the version of PostgreSQL that Debian ships in the potato release since the corresponding functionality is not yet implemented. However, PostgreSQL 6.5.3 is quite old and may bear more risks than we are aware of, which may include further buffer overflows, and certainly include bugs that threaten the integrity of your data.\n\nYou are strongly advised not to use this release but to upgrade your system to Debian 3.0 (stable) including PostgreSQL release 7.2.1 instead, where many bugs have been fixed and new features introduced to increase compatibility with the SQL standards.\n\nIf you consider an upgrade, please make sure to dump the entire database system using the pg_dumpall utility. Please take into consideration that the newer PostgreSQL is more strict in its input handling. This means that tests like 'foo = NULL' which are not valid won't be accepted anymore. It also means that when using UNICODE encoding, ISO 8859-1 and ISO 8859-15 are no longer valid encodings to use when inserting data into the relation. In such a case you are advised to convert the dump in question usingrecode latin1..utf-16.\n\nThese problems have been fixed in version 7.2.1-2woody2 for the current stable distribution (woody) and in version 7.2.2-2 for the unstable distribution (sid). The old stable distribution (potato) is partially affected and we ship a fixed version 6.5.3-27.2 for it.", "edition": 6, "reporter": "Tenable", "published": "2004-09-29T00:00:00", "title": "Debian DSA-165-1 : postgresql - buffer overflows", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 5.0}}, "naslFamily": "Debian Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2002-1398", "CVE-2002-1401", "CVE-2002-1402", "CVE-2002-0972", "CVE-2002-1397", "CVE-2002-1400"], "modified": "2018-08-09T00:00:00", "cpe": ["cpe:/o:debian:debian_linux:2.2", "cpe:/o:debian:debian_linux:3.0", "p-cpe:/a:debian:debian_linux:postgresql"], "id": "DEBIAN_DSA-165.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=15002", "sourceData": "#%NASL_MIN_LEVEL 70103\n\n#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Debian Security Advisory DSA-165. The text \n# itself is copyright (C) Software in the Public Interest, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(15002);\n script_version(\"1.18\");\n script_cvs_date(\"Date: 2018/08/09 17:06:36\");\n\n script_cve_id(\"CVE-2002-0972\", \"CVE-2002-1397\", \"CVE-2002-1398\", \"CVE-2002-1400\", \"CVE-2002-1401\", \"CVE-2002-1402\");\n script_xref(name:\"DSA\", value:\"165\");\n\n script_name(english:\"Debian DSA-165-1 : postgresql - buffer overflows\");\n script_summary(english:\"Checks dpkg output for the updated package\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Debian host is missing a security-related update.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Mordred Labs and others found several vulnerabilities in PostgreSQL,\nan object-relational SQL database. They are inherited from several\nbuffer overflows and integer overflows. Specially crafted long date\nand time input, currency, repeat data and long timezone names could\ncause the PostgreSQL server to crash as well as specially crafted\ninput data for lpad() and rpad(). More buffer/integer overflows were\nfound in circle_poly(), path_encode() and path_addr().\n\nExcept for the last three, these problems are fixed in the upstream\nrelease 7.2.2 of PostgreSQL which is the recommended version to use.\n\nMost of these problems do not exist in the version of PostgreSQL that\nDebian ships in the potato release since the corresponding\nfunctionality is not yet implemented. However, PostgreSQL 6.5.3 is\nquite old and may bear more risks than we are aware of, which may\ninclude further buffer overflows, and certainly include bugs that\nthreaten the integrity of your data.\n\nYou are strongly advised not to use this release but to upgrade your\nsystem to Debian 3.0 (stable) including PostgreSQL release 7.2.1\ninstead, where many bugs have been fixed and new features introduced\nto increase compatibility with the SQL standards.\n\nIf you consider an upgrade, please make sure to dump the entire\ndatabase system using the pg_dumpall utility. Please take into\nconsideration that the newer PostgreSQL is more strict in its input\nhandling. This means that tests like 'foo = NULL' which are not valid\nwon't be accepted anymore. It also means that when using UNICODE\nencoding, ISO 8859-1 and ISO 8859-15 are no longer valid encodings to\nuse when inserting data into the relation. In such a case you are\nadvised to convert the dump in question usingrecode latin1..utf-16.\n\nThese problems have been fixed in version 7.2.1-2woody2 for the\ncurrent stable distribution (woody) and in version 7.2.2-2 for the\nunstable distribution (sid). The old stable distribution (potato) is\npartially affected and we ship a fixed version 6.5.3-27.2 for it.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://www.debian.org/security/2002/dsa-165\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Upgrade the PostgreSQL packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:debian:debian_linux:postgresql\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:2.2\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:debian:debian_linux:3.0\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/09/12\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2004/09/29\");\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/08/19\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2004-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Debian Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/Debian/release\", \"Host/Debian/dpkg-l\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"debian_package.inc\");\n\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nif (!get_kb_item(\"Host/Debian/release\")) audit(AUDIT_OS_NOT, \"Debian\");\nif (!get_kb_item(\"Host/Debian/dpkg-l\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\n\nflag = 0;\nif (deb_check(release:\"2.2\", prefix:\"ecpg\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"libpgperl\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"libpgsql2\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"libpgtcl\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"odbc-postgresql\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"pgaccess\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"postgresql\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"postgresql-client\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"postgresql-contrib\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"postgresql-dev\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"postgresql-doc\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"postgresql-pl\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"postgresql-test\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"2.2\", prefix:\"python-pygresql\", reference:\"6.5.3-27.2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"courier-authpostgresql\", reference:\"0.37.3-3.1\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"libecpg3\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"libpgperl\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"libpgsql2\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"libpgtcl\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"odbc-postgresql\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"pgaccess\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"postgresql\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"postgresql-client\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"postgresql-contrib\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"postgresql-dev\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"postgresql-doc\", reference:\"7.2.1-2woody2\")) flag++;\nif (deb_check(release:\"3.0\", prefix:\"python-pygresql\", reference:\"7.2.1-2woody2\")) flag++;\n\nif (flag)\n{\n if (report_verbosity > 0) security_hole(port:0, extra:deb_report_get());\n else security_hole(0);\n exit(0);\n}\nelse audit(AUDIT_HOST_NOT, \"affected\");\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}, {"lastseen": "2018-09-01T23:42:10", "references": [], "pluginID": "11456", "description": "The remote PostgreSQL server, according to its version number, is vulnerable to various flaws which may allow an attacker who has the rights to query the remote database to obtain a shell on this host.", "edition": 5, "reporter": "Tenable", "published": "2003-03-24T00:00:00", "title": "PostgreSQL < 7.2.3 Multiple Vulnerabilities", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.5}}, "naslFamily": "Databases", "bulletinFamily": "scanner", "cvelist": ["CVE-2002-1398", "CVE-2002-1401", "CVE-2002-1402", "CVE-2002-1397", "CVE-2002-1400", "CVE-2002-1399"], "modified": "2018-07-25T00:00:00", "cpe": ["cpe:/a:postgresql:postgresql"], "id": "POSTGRESQL_MULTIPLE_FLAWS.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=11456", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(11456);\n script_version(\"1.23\");\n script_cvs_date(\"Date: 2018/07/25 18:58:03\");\n\n script_cve_id(\n \"CVE-2002-1397\",\n \"CVE-2002-1398\",\n \"CVE-2002-1399\",\n \"CVE-2002-1400\",\n \"CVE-2002-1401\",\n \"CVE-2002-1402\"\n );\n script_bugtraq_id(\n 5497,\n 5527,\n 6610,\n 6611,\n 6612,\n 6613,\n 6614,\n 6615,\n 7075\n );\n script_xref(name:\"RHSA\", value:\"2003:0010-10\");\n\n script_name(english:\"PostgreSQL < 7.2.3 Multiple Vulnerabilities\");\n script_summary(english:\"Attempts to log into the remote PostgreSQL daemon\");\n\n script_set_attribute(attribute:\"synopsis\", value:\"Arbitrary commands may be run on the remote server.\");\n script_set_attribute(attribute:\"description\", value:\n\"The remote PostgreSQL server, according to its version number, is\nvulnerable to various flaws which may allow an attacker who has the\nrights to query the remote database to obtain a shell on this host.\");\n script_set_attribute(attribute:\"solution\", value:\"Upgrade to postgresql 7.2.3 or later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:P\");\n script_set_cvss_temporal_vector(\"CVSS2#E:U/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"No known exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"false\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"vuln_publication_date\", value:\"2002/08/12\");\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2002/10/01\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2003/03/24\");\n\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:postgresql:postgresql\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2003-2018 Tenable Network Security, Inc.\");\n script_family(english:\"Databases\");\n\n script_dependencie(\"postgresql_detect.nasl\");\n script_require_ports(\"Services/postgresql\", 5432);\n exit(0);\n}\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nport = get_service(svc:\"postgresql\", default:5432, exit_on_fail:TRUE);\n\n#\n# Request the database 'template1' as the user 'postgres' or 'pgsql'\n#\nzero = raw_string(0x00);\n\nuser[0] = \"postgres\";\nuser[1] = \"pgsql\";\n\nfor(i=0;i<2;i=i+1)\n{\n soc = open_sock_tcp(port);\n if (!soc) audit(AUDIT_PORT_CLOSED, port);\n\n usr = user[i];\n len = 224 - strlen(usr);\n\n req = raw_string(0x00, 0x00, 0x01, 0x28, 0x00, 0x02,\n \t 0x00, 0x00, 0x74, 0x65, 0x6D, 0x70, 0x6C, 0x61,\n\t\t 0x74, 0x65, 0x31) + crap(data:zero, length:55) +\n usr +\n crap(data:zero, length:len);\n\n send(socket:soc, data:req);\n r = recv(socket:soc, length:5);\n r2 = recv(socket:soc, length:1024);\n if((r[0]==\"R\") && (strlen(r2) == 10))\n {\n dbs = \"\";\n req = raw_string(0x51) + \"select version();\" +\n \t raw_string(0x00);\n send(socket:soc, data:req);\n\n r = recv(socket:soc, length:65535);\n r = strstr(r, \"PostgreSQL\");\n if(r != NULL)\n {\n for(i=0;i<strlen(r);i++)\n {\n if(ord(r[i]) == 0)\n \tbreak;\n }\n r = substr(r, 0, i - 1);\n if(ereg(string:r, pattern:\"PostgreSQL ([0-6]\\.|7\\.(2\\.[0-2])|([0-1]\\..*)).*\")){\n \tsecurity_warning(port);\n\t}\n }\n else if(\"ERROR: function version()\" >< r)security_warning(port);\n exit(0);\n }\n}\n\nsoc = open_sock_tcp(port);\nif (!soc) audit(AUDIT_PORT_CLOSED, port);\n\nsend(socket:soc, data:string(\"xx\\r\\n\"));\nr = recv(socket:soc, length:6);\nclose(soc);\nif(\"EFATAL\" >< r)\n{\n if ( report_paranoia < 2 ) exit(0);\n security_warning(port:port, extra: \"\nNessus was not able to remotely determine the version of the remote\nPostgreSQL server, so this might be a false positive.\n\");\n}\n", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-11-16T05:01:59", "references": ["http://online.securityfocus.com/archive/1/288334", "https://access.redhat.com/errata/RHSA-2002:301", "http://marc.info/?l=postgresql-general&m=102995302604086", "http://marc.info/?l=bugtraq&m=102987306029821", "http://online.securityfocus.com/archive/1/288036", "http://lwn.net/Articles/8445/", "https://access.redhat.com/security/cve/cve-2002-1398", "https://access.redhat.com/security/cve/cve-2002-0972", "https://access.redhat.com/security/cve/cve-2002-1397", "http://marc.info/?l=postgresql-announce&m=103062536330644", "http://online.securityfocus.com/archive/1/288305", "https://access.redhat.com/security/cve/cve-2002-1401", "http://marc.info/?l=bugtraq&m=102978152712430", "https://access.redhat.com/security/cve/cve-2002-1400", "https://access.redhat.com/security/cve/cve-2002-1402"], "pluginID": "12343", "description": "Updated PostgreSQL packages are available which correct several minor security vulnerabilities.\n\n[Updated 06 Feb 2003] Added fixed packages for Advanced Workstation 2.1\n\nPostgreSQL is an advanced Object-Relational database management system (DBMS). Red Hat Linux Advanced Server 2.1 shipped with PostgreSQL version 7.1.3 which has several security vulnerabilities.\n\nBuffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of service and possibly execute arbitrary code via long arguments to the lpad or rpad functions. CVE-2002-0972\n\nBuffer overflow in the cash_words() function for PostgreSQL 7.2 and earlier allows local users to cause a denial of service and possibly execute arbitrary code via a malformed argument. CVE-2002-1397\n\nBuffer overflow in the date parser for PostgreSQL before 7.2.2 allows attackers to cause a denial of service and possibly execute arbitrary code via a long date string, referred to as a vulnerability 'in handling long datetime input.' CVE-2002-1398\n\nHeap-based buffer overflow in the repeat() function for PostgreSQL before 7.2.2 allows attackers to execute arbitrary code by causing repeat() to generate a large string. CVE-2002-1400\n\nBuffer overflows in circle_poly, path_encode, and path_add allow attackers to cause a denial of service and possibly execute arbitrary code. Note that these issues have been fixed in our packages and in PostgreSQL CVS, but are not included in PostgreSQL version 7.2.2 or 7.2.3. CVE-2002-1401\n\nBuffer overflows in the TZ and SET TIME ZONE enivronment variables for PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service and possibly execute arbitrary code. CVE-2002-1402\n\nNote that these vulnerabilities are only critical on open or shared systems because connecting to the database is required before the vulnerabilities can be exploited.\n\nThe PostgreSQL Global Development Team has released versions of PostgreSQL that fix these vulnerabilities, and these fixes have been isolated and backported into the updated 7.1.3 packages provided with this errata. All users of Red Hat Linux Advanced Server 2.1 who use PostgreSQL are advised to install these updated packages.", "edition": 7, "reporter": "Tenable", "published": "2004-07-06T00:00:00", "title": "RHEL 2.1 : postgresql (RHSA-2002:301)", "type": "nessus", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "naslFamily": "Red Hat Local Security Checks", "bulletinFamily": "scanner", "cvelist": ["CVE-2002-1398", "CVE-2002-1401", "CVE-2002-1402", "CVE-2002-0972", "CVE-2002-1397", "CVE-2002-1400"], "modified": "2018-11-15T00:00:00", "cpe": ["cpe:/o:redhat:enterprise_linux:2.1", "p-cpe:/a:redhat:enterprise_linux:postgresql-tk", "p-cpe:/a:redhat:enterprise_linux:postgresql-devel", "p-cpe:/a:redhat:enterprise_linux:postgresql-docs", "p-cpe:/a:redhat:enterprise_linux:postgresql-odbc", "p-cpe:/a:redhat:enterprise_linux:postgresql-tcl", "p-cpe:/a:redhat:enterprise_linux:postgresql", "p-cpe:/a:redhat:enterprise_linux:postgresql-jdbc", "p-cpe:/a:redhat:enterprise_linux:postgresql-server", "p-cpe:/a:redhat:enterprise_linux:postgresql-python", "p-cpe:/a:redhat:enterprise_linux:postgresql-perl", "p-cpe:/a:redhat:enterprise_linux:postgresql-contrib", "p-cpe:/a:redhat:enterprise_linux:postgresql-libs"], "id": "REDHAT-RHSA-2002-301.NASL", "href": "https://www.tenable.com/plugins/index.php?view=single&id=12343", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n# The descriptive text and package checks in this plugin were \n# extracted from Red Hat Security Advisory RHSA-2002:301. The text \n# itself is copyright (C) Red Hat, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(12343);\n script_version (\"1.22\");\n script_cvs_date(\"Date: 2018/11/15 11:40:29\");\n\n script_cve_id(\"CVE-2002-0972\", \"CVE-2002-1397\", \"CVE-2002-1398\", \"CVE-2002-1400\", \"CVE-2002-1401\", \"CVE-2002-1402\");\n script_xref(name:\"RHSA\", value:\"2002:301\");\n\n script_name(english:\"RHEL 2.1 : postgresql (RHSA-2002:301)\");\n script_summary(english:\"Checks the rpm output for the updated packages\");\n\n script_set_attribute(\n attribute:\"synopsis\", \n value:\"The remote Red Hat host is missing one or more security updates.\"\n );\n script_set_attribute(\n attribute:\"description\", \n value:\n\"Updated PostgreSQL packages are available which correct several minor\nsecurity vulnerabilities.\n\n[Updated 06 Feb 2003] Added fixed packages for Advanced Workstation\n2.1\n\nPostgreSQL is an advanced Object-Relational database management system\n(DBMS). Red Hat Linux Advanced Server 2.1 shipped with PostgreSQL\nversion 7.1.3 which has several security vulnerabilities.\n\nBuffer overflows in PostgreSQL 7.2 allow attackers to cause a denial\nof service and possibly execute arbitrary code via long arguments to\nthe lpad or rpad functions. CVE-2002-0972\n\nBuffer overflow in the cash_words() function for PostgreSQL 7.2 and\nearlier allows local users to cause a denial of service and possibly\nexecute arbitrary code via a malformed argument. CVE-2002-1397\n\nBuffer overflow in the date parser for PostgreSQL before 7.2.2 allows\nattackers to cause a denial of service and possibly execute arbitrary\ncode via a long date string, referred to as a vulnerability 'in\nhandling long datetime input.' CVE-2002-1398\n\nHeap-based buffer overflow in the repeat() function for PostgreSQL\nbefore 7.2.2 allows attackers to execute arbitrary code by causing\nrepeat() to generate a large string. CVE-2002-1400\n\nBuffer overflows in circle_poly, path_encode, and path_add allow\nattackers to cause a denial of service and possibly execute arbitrary\ncode. Note that these issues have been fixed in our packages and in\nPostgreSQL CVS, but are not included in PostgreSQL version 7.2.2 or\n7.2.3. CVE-2002-1401\n\nBuffer overflows in the TZ and SET TIME ZONE enivronment variables for\nPostgreSQL 7.2.1 and earlier allow local users to cause a denial of\nservice and possibly execute arbitrary code. CVE-2002-1402\n\nNote that these vulnerabilities are only critical on open or shared\nsystems because connecting to the database is required before the\nvulnerabilities can be exploited.\n\nThe PostgreSQL Global Development Team has released versions of\nPostgreSQL that fix these vulnerabilities, and these fixes have been\nisolated and backported into the updated 7.1.3 packages provided with\nthis errata. All users of Red Hat Linux Advanced Server 2.1 who use\nPostgreSQL are advised to install these updated packages.\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2002-0972\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2002-1397\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2002-1398\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2002-1400\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2002-1401\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/security/cve/cve-2002-1402\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://lwn.net/Articles/8445/\"\n );\n # http://marc.theaimsgroup.com/?l=postgresql-announce&m=103062536330644\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://marc.info/?l=postgresql-announce&m=103062536330644\"\n );\n # http://marc.theaimsgroup.com/?l=bugtraq&m=102978152712430\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://marc.info/?l=bugtraq&m=102978152712430\"\n );\n # http://marc.theaimsgroup.com/?l=bugtraq&m=102987306029821\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://marc.info/?l=bugtraq&m=102987306029821\"\n );\n # http://marc.theaimsgroup.com/?l=postgresql-general&m=102995302604086\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://marc.info/?l=postgresql-general&m=102995302604086\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://online.securityfocus.com/archive/1/288334\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://online.securityfocus.com/archive/1/288305\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"http://online.securityfocus.com/archive/1/288036\"\n );\n script_set_attribute(\n attribute:\"see_also\",\n value:\"https://access.redhat.com/errata/RHSA-2002:301\"\n );\n script_set_attribute(attribute:\"solution\", value:\"Update the affected packages.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P\");\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_type\", value:\"local\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-contrib\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-devel\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-docs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-jdbc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-libs\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-odbc\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-perl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-python\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-server\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-tcl\");\n script_set_attribute(attribute:\"cpe\", value:\"p-cpe:/a:redhat:enterprise_linux:postgresql-tk\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/o:redhat:enterprise_linux:2.1\");\n\n script_set_attribute(attribute:\"patch_publication_date\", value:\"2003/02/05\");\n script_set_attribute(attribute:\"plugin_publication_date\", value:\"2004/07/06\");\n script_end_attributes();\n\n script_category(ACT_GATHER_INFO);\n script_copyright(english:\"This script is Copyright (C) 2004-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n script_family(english:\"Red Hat Local Security Checks\");\n\n script_dependencies(\"ssh_get_info.nasl\");\n script_require_keys(\"Host/local_checks_enabled\", \"Host/RedHat/release\", \"Host/RedHat/rpm-list\", \"Host/cpu\");\n\n exit(0);\n}\n\n\ninclude(\"audit.inc\");\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"rpm.inc\");\n\nif (!get_kb_item(\"Host/local_checks_enabled\")) audit(AUDIT_LOCAL_CHECKS_NOT_ENABLED);\nrelease = get_kb_item(\"Host/RedHat/release\");\nif (isnull(release) || \"Red Hat\" >!< release) audit(AUDIT_OS_NOT, \"Red Hat\");\nos_ver = eregmatch(pattern: \"Red Hat Enterprise Linux.*release ([0-9]+(\\.[0-9]+)?)\", string:release);\nif (isnull(os_ver)) audit(AUDIT_UNKNOWN_APP_VER, \"Red Hat\");\nos_ver = os_ver[1];\nif (! ereg(pattern:\"^2\\.1([^0-9]|$)\", string:os_ver)) audit(AUDIT_OS_NOT, \"Red Hat 2.1\", \"Red Hat \" + os_ver);\n\nif (!get_kb_item(\"Host/RedHat/rpm-list\")) audit(AUDIT_PACKAGE_LIST_MISSING);\n\ncpu = get_kb_item(\"Host/cpu\");\nif (isnull(cpu)) audit(AUDIT_UNKNOWN_ARCH);\nif (\"x86_64\" >!< cpu && cpu !~ \"^i[3-6]86$\" && \"s390\" >!< cpu) audit(AUDIT_LOCAL_CHECKS_NOT_IMPLEMENTED, \"Red Hat\", cpu);\nif (cpu !~ \"^i[3-6]86$\") audit(AUDIT_ARCH_NOT, \"i386\", cpu);\n\nyum_updateinfo = get_kb_item(\"Host/RedHat/yum-updateinfo\");\nif (!empty_or_null(yum_updateinfo)) \n{\n rhsa = \"RHSA-2002:301\";\n yum_report = redhat_generate_yum_updateinfo_report(rhsa:rhsa);\n if (!empty_or_null(yum_report))\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : yum_report \n );\n exit(0);\n }\n else\n {\n audit_message = \"affected by Red Hat security advisory \" + rhsa;\n audit(AUDIT_OS_NOT, audit_message);\n }\n}\nelse\n{\n flag = 0;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-contrib-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-devel-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-docs-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-jdbc-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-libs-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-odbc-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-perl-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-python-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-server-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-tcl-7.1.3-4bp.2\")) flag++;\n if (rpm_check(release:\"RHEL2.1\", cpu:\"i386\", reference:\"postgresql-tk-7.1.3-4bp.2\")) flag++;\n\n if (flag)\n {\n security_report_v4(\n port : 0,\n severity : SECURITY_HOLE,\n extra : rpm_report_get() + redhat_report_package_caveat()\n );\n exit(0);\n }\n else\n {\n tested = pkg_tests_get();\n if (tested) audit(AUDIT_PACKAGE_NOT_AFFECTED, tested);\n else audit(AUDIT_PACKAGE_NOT_INSTALLED, \"postgresql / postgresql-contrib / postgresql-devel / etc\");\n }\n}\n", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}], "redhat": [{"lastseen": "2018-03-28T01:01:46", "_object_types": ["robots.models.base.Bulletin", "robots.models.redhat.RedHatBulletin"], "references": [], "affectedPackage": [{"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-tk-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-tk", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-tcl-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-tcl", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-jdbc-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-jdbc", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-python-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-python", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-docs-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-docs", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-perl-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-perl", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-libs-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-libs", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-perl-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-perl", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-libs-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-libs", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-server-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-server", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-python-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-python", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-devel-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-devel", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-docs-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-docs", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-jdbc-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-jdbc", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-contrib-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-contrib", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-contrib-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-contrib", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-odbc-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-odbc", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-odbc-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-odbc", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-tcl-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-tcl", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-server-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-server", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "i386", "packageFilename": "postgresql-devel-7.1.3-4bp.2.i386.rpm", "packageName": "postgresql-devel", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql", "operator": "lt"}, {"OS": "RedHat", "OSVersion": "any", "packageVersion": "7.1.3-4bp.2", "arch": "ia64", "packageFilename": "postgresql-tk-7.1.3-4bp.2.ia64.rpm", "packageName": "postgresql-tk", "operator": "lt"}], "description": "PostgreSQL is an advanced Object-Relational database management system\n(DBMS). Red Hat Linux Advanced Server 2.1 shipped with PostgreSQL version\n7.1.3 which has several security vulnerabilities. \n\nBuffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of\nservice and possibly execute arbitrary code via long arguments to the lpad\nor rpad functions. CAN-2002-0972\n\nBuffer overflow in the cash_words() function for PostgreSQL 7.2 and\nearlier allows local users to cause a denial of service and possibly\nexecute arbitrary code via a malformed argument. CAN-2002-1397\n\nBuffer overflow in the date parser for PostgreSQL before 7.2.2 allows\nattackers to cause a denial of service and possibly execute arbitrary\ncode via a long date string, referred to as a vulnerability \"in handling\nlong datetime input.\" CAN-2002-1398\n\nHeap-based buffer overflow in the repeat() function for PostgreSQL\nbefore 7.2.2 allows attackers to execute arbitrary code by causing\nrepeat() to generate a large string. CAN-2002-1400\n\nBuffer overflows in circle_poly, path_encode, and path_add allow attackers\nto cause a denial of service and possibly execute arbitrary code. Note\nthat these issues have been fixed in our packages and in PostgreSQL CVS,\nbut are not included in PostgreSQL version 7.2.2 or 7.2.3. CAN-2002-1401\n\nBuffer overflows in the TZ and SET TIME ZONE enivronment variables for\nPostgreSQL 7.2.1 and earlier allow local users to cause a denial of service\nand possibly execute arbitrary code. CAN-2002-1402\n\nNote that these vulnerabilities are only critical on open or shared systems\nbecause connecting to the database is required before the vulnerabilities\ncan be exploited.\n\nThe PostgreSQL Global Development Team has released versions of PostgreSQL\nthat fix these vulnerabilities, and these fixes have been isolated and\nbackported into the updated 7.1.3 packages provided with this errata.\nAll users of Red Hat Linux Advanced Server 2.1 who use PostgreSQL are\nadvised to install these updated packages.", "reporter": "RedHat", "published": "2003-02-06T05:00:00", "type": "redhat", "title": "(RHSA-2002:301) postgresql security update", "enchantments": {"score": {"vector": "NONE", "value": 7.2}}, "bulletinFamily": "unix", "cvelist": ["CVE-2002-0972", "CVE-2002-1397", "CVE-2002-1398", "CVE-2002-1400", "CVE-2002-1401", "CVE-2002-1402"], "_object_type": "robots.models.redhat.RedHatBulletin", "modified": "2018-03-14T19:27:29", "id": "RHSA-2002:301", "href": "https://access.redhat.com/errata/RHSA-2002:301", "cvss": {"score": 7.5, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:PARTIAL/I:PARTIAL/A:PARTIAL/"}}]}