Lucene search

K
freebsdFreeBSD42D42090-9A4D-11E3-B029-08002798F6FF
HistoryFeb 20, 2014 - 12:00 a.m.

PostgreSQL -- multiple privilege issues

2014-02-2000:00:00
vuxml.freebsd.org
12

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.927 High

EPSS

Percentile

99.0%

PostgreSQL Project reports:

This update fixes CVE-2014-0060, in which PostgreSQL did not
properly enforce the WITH ADMIN OPTION permission for ROLE management.
Before this fix, any member of a ROLE was able to grant others access
to the same ROLE regardless if the member was given the WITH ADMIN
OPTION permission. It also fixes multiple privilege escalation issues,
including: CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064,
CVE-2014-0065, and CVE-2014-0066. More information on these issues can
be found on our security page and the security issue detail wiki page.

  With this release, we are also alerting users to a known security hole
  that allows other users on the same machine to gain access to an
  operating system account while it is doing "make check":
  CVE-2014-0067. "Make check" is normally part of building PostgreSQL
  from source code. As it is not possible to fix this issue without
  causing significant issues to our testing infrastructure, a patch will
  be released separately and publicly. Until then, users are strongly
  advised not to run "make check" on machines where untrusted users have
  accounts.
OSVersionArchitecturePackageVersionFilename
FreeBSDanynoarchpostgresql-server< 8.4.20UNKNOWN

6.5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

0.927 High

EPSS

Percentile

99.0%