CVE-2009-3230

PostgreSQL 7.4-8.4 - Authenticated Privilege Escalation via RESET ROLE and RESET SESSION AUTHORIZATION

Title source: llm
STIX 2.1

Description

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.

References (22)

Core 22
Core References
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2009/2602
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/36314
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=134124585221119&w=2
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/36837
Various Sources mailing-list x_refsource_mlist
http://archives.postgresql.org/pgsql-www/2009-09/msg00024.php
Vendor Advisory x_refsource_confirm
http://www.postgresql.org/support/security.html
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=522085
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/36660
Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq
http://www.securityfocus.com/archive/1/509917/100/0/threaded
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/36800
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10166
Third Party Advisory vendor-advisory x_refsource_debian
http://www.us.debian.org/security/2009/dsa-1900
Vendor Advisory vendor-advisory x_refsource_sunalert
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/36727
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/usn-834-1
Third Party Advisory x_refsource_confirm
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/36695

Scores

EPSS 0.0085
EPSS Percentile 75.2%

Details

CWE
CWE-264
Status published
Products (50)
postgresql/postgresql 7.4
postgresql/postgresql 7.4.1
postgresql/postgresql 7.4.2
postgresql/postgresql 7.4.3
postgresql/postgresql 7.4.4
postgresql/postgresql 7.4.5
postgresql/postgresql 7.4.6
postgresql/postgresql 7.4.7
postgresql/postgresql 7.4.8
postgresql/postgresql 7.4.9
... and 40 more
Published Sep 17, 2009
Tracked Since Feb 18, 2026