PostgreSQL vulnerability

ID USN-71-1
Type ubuntu
Reporter Ubuntu
Modified 2005-02-01T00:00:00


John Heasman discovered a local privilege escalation in the PostgreSQL server. Any user could use the LOAD extension to load any shared library into the PostgreSQL server; the library’s initialisation function was then executed with the permissions of the server.

Now the use of LOAD is restricted to the database superuser (usually ‘postgres’).

Note: Since there is no way for normal database users to create arbitrary files, this vulnerability is not exploitable remotely, e. g. by uploading a shared library in the form of a Binary Large Object (BLOB) to a public web server.