Lucene search

[email protected]NVD:CVE-2010-3433

HistoryOct 06, 2010 - 5:00 p.m.

CVE-2010-3433

2010-10-0617:00:16

CWE-264

[email protected]

web.nvd.nist.gov

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

7.1 High

AI Score

Confidence

Low

0.04 Low

EPSS

Percentile

92.1%

JSON

The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.

Affected configurations

NVD

Node

postgresqlpostgresqlMatch7.4

postgresqlpostgresqlMatch7.4.1

postgresqlpostgresqlMatch7.4.2

postgresqlpostgresqlMatch7.4.3

postgresqlpostgresqlMatch7.4.4

postgresqlpostgresqlMatch7.4.5

postgresqlpostgresqlMatch7.4.6

postgresqlpostgresqlMatch7.4.7

postgresqlpostgresqlMatch7.4.8

postgresqlpostgresqlMatch7.4.9

postgresqlpostgresqlMatch7.4.10

postgresqlpostgresqlMatch7.4.11

postgresqlpostgresqlMatch7.4.12

postgresqlpostgresqlMatch7.4.13

postgresqlpostgresqlMatch7.4.14

postgresqlpostgresqlMatch7.4.15

postgresqlpostgresqlMatch7.4.16

postgresqlpostgresqlMatch7.4.17

postgresqlpostgresqlMatch7.4.18

postgresqlpostgresqlMatch7.4.19

postgresqlpostgresqlMatch7.4.20

postgresqlpostgresqlMatch7.4.21

postgresqlpostgresqlMatch7.4.22

postgresqlpostgresqlMatch7.4.23

postgresqlpostgresqlMatch7.4.24

postgresqlpostgresqlMatch7.4.25

postgresqlpostgresqlMatch7.4.26

postgresqlpostgresqlMatch7.4.27

postgresqlpostgresqlMatch7.4.28

postgresqlpostgresqlMatch7.4.29

Node

postgresqlpostgresqlMatch8.0

postgresqlpostgresqlMatch8.0.1

postgresqlpostgresqlMatch8.0.2

postgresqlpostgresqlMatch8.0.3

postgresqlpostgresqlMatch8.0.4

postgresqlpostgresqlMatch8.0.5

postgresqlpostgresqlMatch8.0.6

postgresqlpostgresqlMatch8.0.7

postgresqlpostgresqlMatch8.0.8

postgresqlpostgresqlMatch8.0.9

postgresqlpostgresqlMatch8.0.10

postgresqlpostgresqlMatch8.0.11

postgresqlpostgresqlMatch8.0.12

postgresqlpostgresqlMatch8.0.13

postgresqlpostgresqlMatch8.0.14

postgresqlpostgresqlMatch8.0.15

postgresqlpostgresqlMatch8.0.16

postgresqlpostgresqlMatch8.0.17

postgresqlpostgresqlMatch8.0.18

postgresqlpostgresqlMatch8.0.19

postgresqlpostgresqlMatch8.0.20

postgresqlpostgresqlMatch8.0.21

postgresqlpostgresqlMatch8.0.22

postgresqlpostgresqlMatch8.0.23

postgresqlpostgresqlMatch8.0.24

postgresqlpostgresqlMatch8.0.25

Node

postgresqlpostgresqlMatch8.1

postgresqlpostgresqlMatch8.1.1

postgresqlpostgresqlMatch8.1.2

postgresqlpostgresqlMatch8.1.3

postgresqlpostgresqlMatch8.1.4

postgresqlpostgresqlMatch8.1.5

postgresqlpostgresqlMatch8.1.6

postgresqlpostgresqlMatch8.1.7

postgresqlpostgresqlMatch8.1.8

postgresqlpostgresqlMatch8.1.9

postgresqlpostgresqlMatch8.1.10

postgresqlpostgresqlMatch8.1.11

postgresqlpostgresqlMatch8.1.12

postgresqlpostgresqlMatch8.1.13

postgresqlpostgresqlMatch8.1.14

postgresqlpostgresqlMatch8.1.15

postgresqlpostgresqlMatch8.1.16

postgresqlpostgresqlMatch8.1.17

postgresqlpostgresqlMatch8.1.18

postgresqlpostgresqlMatch8.1.19

postgresqlpostgresqlMatch8.1.20

postgresqlpostgresqlMatch8.1.21

Node

postgresqlpostgresqlMatch8.2

postgresqlpostgresqlMatch8.2.1

postgresqlpostgresqlMatch8.2.2

postgresqlpostgresqlMatch8.2.3

postgresqlpostgresqlMatch8.2.4

postgresqlpostgresqlMatch8.2.5

postgresqlpostgresqlMatch8.2.6

postgresqlpostgresqlMatch8.2.7

postgresqlpostgresqlMatch8.2.8

postgresqlpostgresqlMatch8.2.9

postgresqlpostgresqlMatch8.2.10

postgresqlpostgresqlMatch8.2.11

postgresqlpostgresqlMatch8.2.12

postgresqlpostgresqlMatch8.2.13

postgresqlpostgresqlMatch8.2.14

postgresqlpostgresqlMatch8.2.15

postgresqlpostgresqlMatch8.2.16

postgresqlpostgresqlMatch8.2.17

Node

postgresqlpostgresqlMatch8.3

postgresqlpostgresqlMatch8.3.1

postgresqlpostgresqlMatch8.3.2

postgresqlpostgresqlMatch8.3.3

postgresqlpostgresqlMatch8.3.4

postgresqlpostgresqlMatch8.3.5

postgresqlpostgresqlMatch8.3.6

postgresqlpostgresqlMatch8.3.7

postgresqlpostgresqlMatch8.3.8

postgresqlpostgresqlMatch8.3.9

postgresqlpostgresqlMatch8.3.10

postgresqlpostgresqlMatch8.3.11

Node

postgresqlpostgresqlMatch8.4

postgresqlpostgresqlMatch8.4.1

postgresqlpostgresqlMatch8.4.2

postgresqlpostgresqlMatch8.4.3

postgresqlpostgresqlMatch8.4.4

Node

postgresqlpostgresqlMatch9.0

References

kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

lists.fedoraproject.org/pipermail/package-announce/2010-October/049591.html

lists.fedoraproject.org/pipermail/package-announce/2010-October/049592.html

lists.opensuse.org/opensuse-security-announce/2010-10/msg00006.html

lists.opensuse.org/opensuse-security-announce/2010-11/msg00001.html

marc.info/?l=bugtraq&m=134124585221119&w=2

secunia.com/advisories/42325

www.debian.org/security/2010/dsa-2120

www.mandriva.com/security/advisories?name=MDVSA-2010:197

www.postgresql.org/about/news.1244

www.postgresql.org/docs/9.0/static/release-9-0-1.html

www.redhat.com/support/errata/RHSA-2010-0742.html

www.redhat.com/support/errata/RHSA-2010-0908.html

www.securityfocus.com/bid/43747

www.ubuntu.com/usn/USN-1002-1

www.ubuntu.com/usn/USN-1002-2

www.vupen.com/english/advisories/2010/3051

bugzilla.redhat.com/show_bug.cgi?id=639371

oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7291

6 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

7.1 High

AI Score

Confidence

Low

0.04 Low

EPSS

Percentile

92.1%

JSON

Related for NVD:CVE-2010-3433

prion3 debian6 cve2 cvelist3 ubuntucve4 openvas72 fedora12 seebug1 nessus64 threatpost1 oraclelinux4 securityvulns6 redhat5 nvd2 osv2 centos3 ubuntu3 veracode4 postgresql2