CVE-2010-0442
PostgreSQL 7.4-7.4.28 - Denial of Service via Negative Integer in bitsubstr Function
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2010-0442. PoCs published by Intevydis.
AI-analyzed exploit summary This exploit demonstrates a buffer overflow vulnerability in PostgreSQL by using a crafted substring function call with a binary string. The overflow occurs due to inadequate boundary checks, potentially leading to arbitrary code execution or application crash.
Description
The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
Exploits (1)
This exploit demonstrates a buffer overflow vulnerability in PostgreSQL by using a crafted substring function call with a binary string. The overflow occurs due to inadequate boundary checks, potentially leading to arbitrary code execution or application crash.