CVE-2009-3231

Postgresql < 8.2.14 - Authentication Bypass

Title source: rule

Description

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

References (17)

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html

[Mailing List] http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html

[Mailing List] http://marc.info/?l=bugtraq&m=134124585221119&w=2

[Broken Link, Vendor Advisory] http://secunia.com/advisories/36660

[Broken Link, Vendor Advisory] http://secunia.com/advisories/36727

[Broken Link] http://secunia.com/advisories/36800

[Broken Link] http://secunia.com/advisories/36837

[Broken Link] http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012

[Release Notes] http://www.postgresql.org/docs/8.3/static/release-8-3-8.html

[Broken Link, Vendor Advisory] http://www.postgresql.org/support/security.html

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/509917/100/0/threaded

[Broken Link, Third Party Advisory, VDB Entry] http://www.securityfocus.com/bid/36314

[Third Party Advisory] http://www.ubuntu.com/usn/usn-834-1

[Broken Link] http://www.us.debian.org/security/2009/dsa-1900

[Issue Tracking, Patch] https://bugzilla.redhat.com/show_bug.cgi?id=522084

[Mailing List] https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html

[Mailing List] https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html

Scores

EPSS 0.0496

EPSS Percentile 89.5%

Classification

CWE

CWE-287

Status draft

Affected Products (11)

postgresql/postgresql < 8.2.14

opensuse/opensuse < 11.1

suse/linux_enterprise

suse/linux_enterprise_server

fedoraproject/fedora

canonical/ubuntu_linux

Timeline

Published Sep 17, 2009

Tracked Since Feb 18, 2026