[SECURITY] [DSA 1460-1] New postgresql-8.1 packages fix several vulnerabilities

2008-01-1315:45:01

lists.debian.org

Debian Security Advisory DSA-1460-1 [email protected]
http://www.debian.org/security/ Moritz Muehlenhoff
January 13, 2008 http://www.debian.org/security/faq

Package : postgresql-8.1
Vulnerability : several
Problem type : local
Debian-specific: no
CVE Id(s) : CVE-2007-3278 CVE-2007-4769 CVE-2007-4772 CVE-2007-6067 CVE-2007-6600 CVE-2007-6601

Several local vulnerabilities have been discovered in PostgreSQL, an
object-relational SQL database. The Common Vulnerabilities and Exposures
project identifies the following problems:

CVE-2007-3278

It was discovered that the DBLink module performed insufficient
credential validation. This issue is also tracked as CVE-2007-6601,
since the initial upstream fix was incomplete.

CVE-2007-4769

Tavis Ormandy and Will Drewry discovered that a bug in the handling
of back-references inside the regular expressions engine could lead
to an out of bands read, resulting in a crash. This constitutes only
a security problem if an application using ProgreSQL processes
regular expressions from untrusted sources.

CVE-2007-4772

Tavis Ormandy and Will Drewry discovered that the optimizer for regular
expression could be tricked into an infinite loop, resulting in denial
of service. This constitutes only a security problem if an application
using ProgreSQL processes regular expressions from untrusted sources.

CVE-2007-6067

Tavis Ormandy and Will Drewry discovered that the optimizer for regular
expression could be tricked massive ressource consumption. This
constitutes only a security problem if an application using ProgreSQL
processes regular expressions from untrusted sources.

CVE-2007-6600

Functions in index expressions could lead to privilege escalation. For
a more in depth explanation please see the upstream announce available
at http://www.postgresql.org/about/news.905.

For the unstable distribution (sid), these problems have been fixed in
version 8.2.6-1 of postgresql-8.2.

For the stable distribution (etch), these problems have been fixed in version
postgresql-8.1 8.1.11-0etch1.

The old stable distribution (sarge), doesn't contain postgresql-8.1.

We recommend that you upgrade your postgresql-8.1 (8.1.11-0etch1) package.

Upgrade instructions

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian 4.0 (stable)

Stable updates are available for alpha, amd64, arm, hppa, i386, ia64, mips, mipsel, powerpc, s390 and sparc.

Source archives:

http://security.debian.org/pool/updates/main/p/postgresql-8.1/postgresql-8.1_8.1.11-0etch1.diff.gz
Size/MD5 checksum: 35762 c4858189bfd1ef7b426d7ad337293a00
http://security.debian.org/pool/updates/main/p/postgresql-8.1/postgresql-8.1_8.1.11.orig.tar.gz
Size/MD5 checksum: 11444400 9eadd7e16f547a8ce1e0eec5de96632e
http://security.debian.org/pool/updates/main/p/postgresql-8.1/postgresql-8.1_8.1.11-0etch1.dsc
Size/MD5 checksum: 1171 118e1cfc403a8299dfa76fc1e267342e

Architecture independent packages:

http://security.debian.org/pool/updates/main/p/postgresql-8.1/postgresql-doc-8.1_8.1.11-0etch1_all.deb
Size/MD5 checksum: 1597344 fc757ca9e80c49309458624a4d6fd3ab

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: [email protected]
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>

OSVersionArchitecturePackageVersionFilename
Debian4sparcpostgresql-pltcl-8.1< 8.1.11-0etch1postgresql-pltcl-8.1_8.1.11-0etch1_sparc.deb
Debian4sparclibecpg-compat2< 8.1.11-0etch1libecpg-compat2_8.1.11-0etch1_sparc.deb
Debian4armlibecpg5< 8.1.11-0etch1libecpg5_8.1.11-0etch1_arm.deb
Debian4powerpclibecpg-compat2< 8.1.11-0etch1libecpg-compat2_8.1.11-0etch1_powerpc.deb
Debian4ia64libecpg-dev< 8.1.11-0etch1libecpg-dev_8.1.11-0etch1_ia64.deb
Debian4amd64postgresql-pltcl-8.1< 8.1.11-0etch1postgresql-pltcl-8.1_8.1.11-0etch1_amd64.deb
Debian4allpostgresql-8.1< 8.1.11-0etch1postgresql-8.1_8.1.11-0etch1_all.deb
Debian4powerpcpostgresql-server-dev-8.1< 8.1.11-0etch1postgresql-server-dev-8.1_8.1.11-0etch1_powerpc.deb
Debian4powerpclibpq-dev< 8.1.11-0etch1libpq-dev_8.1.11-0etch1_powerpc.deb
Debian4allpostgresql-doc-8.1< 8.1.11-0etch1postgresql-doc-8.1_8.1.11-0etch1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	4	sparc	postgresql-pltcl-8.1	< 8.1.11-0etch1	postgresql-pltcl-8.1_8.1.11-0etch1_sparc.deb
Debian	4	sparc	libecpg-compat2	< 8.1.11-0etch1	libecpg-compat2_8.1.11-0etch1_sparc.deb
Debian	4	arm	libecpg5	< 8.1.11-0etch1	libecpg5_8.1.11-0etch1_arm.deb
Debian	4	powerpc	libecpg-compat2	< 8.1.11-0etch1	libecpg-compat2_8.1.11-0etch1_powerpc.deb
Debian	4	ia64	libecpg-dev	< 8.1.11-0etch1	libecpg-dev_8.1.11-0etch1_ia64.deb
Debian	4	amd64	postgresql-pltcl-8.1	< 8.1.11-0etch1	postgresql-pltcl-8.1_8.1.11-0etch1_amd64.deb
Debian	4	all	postgresql-8.1	< 8.1.11-0etch1	postgresql-8.1_8.1.11-0etch1_all.deb
Debian	4	powerpc	postgresql-server-dev-8.1	< 8.1.11-0etch1	postgresql-server-dev-8.1_8.1.11-0etch1_powerpc.deb
Debian	4	powerpc	libpq-dev	< 8.1.11-0etch1	libpq-dev_8.1.11-0etch1_powerpc.deb
Debian	4	all	postgresql-doc-8.1	< 8.1.11-0etch1	postgresql-doc-8.1_8.1.11-0etch1_all.deb