CVE-2010-3433

PostgreSQL <9.0.1 - Privilege Escalation

Title source: llm
STIX 2.1

Description

The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.

References (19)

Core 19
Core References
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049592.html
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7291
Mailing List vendor-advisory x_refsource_hp
http://marc.info/?l=bugtraq&m=134124585221119&w=2
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1002-2
Issue Tracking x_refsource_confirm
https://bugzilla.redhat.com/show_bug.cgi?id=639371
Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora
http://lists.fedoraproject.org/pipermail/package-announce/2010-October/049591.html
Third Party Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/3051
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0742.html
Vendor Advisory vendor-advisory x_refsource_ubuntu
http://www.ubuntu.com/usn/USN-1002-1
Vendor Advisory vendor-advisory x_refsource_mandriva
http://www.mandriva.com/security/advisories?name=MDVSA-2010:197
Third Party Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/42325
Vendor Advisory vendor-advisory x_refsource_redhat
http://www.redhat.com/support/errata/RHSA-2010-0908.html
Third Party Advisory vendor-advisory x_refsource_debian
http://www.debian.org/security/2010/dsa-2120
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/43747
Patch, Vendor Advisory x_refsource_confirm
http://www.postgresql.org/about/news.1244

Scores

EPSS 0.0166
EPSS Percentile 82.3%

Details

CWE
CWE-264
Status published
Products (50)
postgresql/postgresql 7.4
postgresql/postgresql 7.4.1
postgresql/postgresql 7.4.2
postgresql/postgresql 7.4.3
postgresql/postgresql 7.4.4
postgresql/postgresql 7.4.5
postgresql/postgresql 7.4.6
postgresql/postgresql 7.4.7
postgresql/postgresql 7.4.8
postgresql/postgresql 7.4.9
... and 40 more
Published Oct 06, 2010
Tracked Since Feb 18, 2026