CVE-2009-3230

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.
References
Link Resource
http://archives.postgresql.org/pgsql-www/2009-09/msg00024.php
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://secunia.com/advisories/36660 Vendor Advisory
http://secunia.com/advisories/36695 Vendor Advisory
http://secunia.com/advisories/36727 Vendor Advisory
http://secunia.com/advisories/36800
http://secunia.com/advisories/36837
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
http://www.postgresql.org/docs/8.3/static/release-8-3-8.html Vendor Advisory
http://www.postgresql.org/support/security.html Vendor Advisory
http://www.securityfocus.com/archive/1/509917/100/0/threaded
http://www.securityfocus.com/bid/36314
http://www.ubuntu.com/usn/usn-834-1
http://www.us.debian.org/security/2009/dsa-1900
http://www.vupen.com/english/advisories/2009/2602 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=522085
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10166
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html
http://archives.postgresql.org/pgsql-www/2009-09/msg00024.php
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://secunia.com/advisories/36660 Vendor Advisory
http://secunia.com/advisories/36695 Vendor Advisory
http://secunia.com/advisories/36727 Vendor Advisory
http://secunia.com/advisories/36800
http://secunia.com/advisories/36837
http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
http://www.postgresql.org/docs/8.3/static/release-8-3-8.html Vendor Advisory
http://www.postgresql.org/support/security.html Vendor Advisory
http://www.securityfocus.com/archive/1/509917/100/0/threaded
http://www.securityfocus.com/bid/36314
http://www.ubuntu.com/usn/usn-834-1
http://www.us.debian.org/security/2009/dsa-1900
http://www.vupen.com/english/advisories/2009/2602 Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=522085
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10166
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:postgresql:postgresql:7.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.18:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.19:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.20:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.21:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.22:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.23:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.24:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:7.4.25:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.16:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.17:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.18:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.19:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.20:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.0.21:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.1.16:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.2.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.3.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.3.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.3.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.3.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.3.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.3.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4:*:*:*:*:*:*:*

History

No history.

Information

Published : 2009-09-17 10:30

Updated : 2025-04-09 00:30


NVD link : CVE-2009-3230

Mitre link : CVE-2009-3230

CVE.ORG link : CVE-2009-3230


JSON object : View

Products Affected

postgresql

  • postgresql
CWE
CWE-264

Permissions, Privileges, and Access Controls