CVE-2013-1901

PostgreSQL 9.1.x-9.2.x - Authenticated Privilege Escalation via pg_start_backup and pg_stop_backup Functions

Title source: llm

Description

PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.

References (16)

Core 16

Core References

Various Sources x_refsource_confirm

http://www.postgresql.org/docs/current/static/release-9-2-4.html

Vendor Advisory x_refsource_confirm

http://www.postgresql.org/about/news/1456/

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html

Vendor Advisory vendor-advisory x_refsource_mandriva

http://www.mandriva.com/security/advisories?name=MDVSA-2013:142

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT5892

Vendor Advisory vendor-advisory x_refsource_ubuntu

http://www.ubuntu.com/usn/USN-1789-1

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html

Mailing List vendor-advisory x_refsource_apple

http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html

Various Sources x_refsource_confirm

http://www.postgresql.org/docs/current/static/release-9-1-9.html

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html

Third Party Advisory vendor-advisory x_refsource_debian

http://www.debian.org/security/2013/dsa-2658

Mailing List vendor-advisory x_refsource_suse

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html

Mailing List, Third Party Advisory vendor-advisory x_refsource_fedora

http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html

Vendor Advisory x_refsource_confirm

http://support.apple.com/kb/HT5880

Scores

EPSS 0.0022

EPSS Percentile 43.9%

Details

CWE

CWE-264

Status published

Products (18)

canonical/ubuntu_linux 8.04

canonical/ubuntu_linux 10.04

canonical/ubuntu_linux 11.10

canonical/ubuntu_linux 12.04

canonical/ubuntu_linux 12.10

postgresql/postgresql 9.2

postgresql/postgresql 9.2.1

postgresql/postgresql 9.2.2

postgresql/postgresql 9.2.3

postgresql/postgresql 9.1

... and 8 more

Published Apr 04, 2013

Tracked Since Feb 18, 2026