[USN-6-1] postgresql contributed script vulnerability

From: Martin Pitt (martin.pitt_at_canonical.com)
Date: 10/27/04

Next message: OpenPKG: "[OpenPKG-SA-2004.046] OpenPKG Security Advisory (postgresql)"

Previous message: Crispin Cowan: "Re: Mozilla Firefox (tested on 0.9.3) html-code crash."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Date: Wed, 27 Oct 2004 02:52:20 +0200
To: ubuntu-security-announce@lists.ubuntu.com

===========================================================
Ubuntu Security Notice USN-6-1 October 27, 2004
postgresql contributed script vulnerability
CAN-2004-0977
===========================================================

A security issue affects the following Ubuntu releases:

Ubuntu 4.10 (Warty Warthog)

The following packages are affected:

postgresql-contrib

The problem can be corrected by upgrading the affected package to
version 7.4.5-3ubuntu0.1. In general, a standard system upgrade is
sufficient to effect the necessary changes.

Details follow:

Recently, Trustix Secure Linux discovered a vulnerability in the
postgresql-contrib package. The script "make_oidjoins_check" created
temporary files in an insecure way, which allowed a symlink attack to
create or overwrite arbitrary files with the privileges of the user
invoking the script.

Source archives:

    http://security.ubuntu.com/ubuntu/pool/main/p/postgresql/postgresql_7.4.5-3ubuntu0.1.diff.gz
      Size/MD5: 143783 c495929ea0fc6a9ac76a4a318fae9b38
    http://security.ubuntu.com/ubuntu/pool/main/p/postgresql/postgresql_7.4.5-3ubuntu0.1.dsc
      Size/MD5: 991 57b900c5dd1cb46018a1d1b8a1703843
    http://security.ubuntu.com/ubuntu/pool/main/p/postgresql/postgresql_7.4.5.orig.tar.gz
      Size/MD5: 9895913 a295885a36ed8e7ec7a7e887218ceabc

Architecture independent packages:

http://security.ubuntu.com/ubuntu/pool/main/p/postgresql/postgresql-doc_7.4.5-3ubuntu0.1_all.deb
Size/MD5: 2256072 bc27bf88bbeb8e48a244ff07889690fb

amd64 architecture (Athlon64, Opteron, EM64T Xeon)

i386 architecture (x86 compatible Intel/AMD)

powerpc architecture (Apple Macintosh G3/G4/G5)

application/pgp-signature attachment: Digital signature

Next message: OpenPKG: "[OpenPKG-SA-2004.046] OpenPKG Security Advisory (postgresql)"

Previous message: Crispin Cowan: "Re: Mozilla Firefox (tested on 0.9.3) html-code crash."
Messages sorted by: [ date ] [ thread ] [ subject ] [ author ] [ attachment ]

Relevant Pages

[USN-6-1] postgresql contributed script vulnerability
... Ubuntu 4.10 ... The following packages are affected: ... postgresql-contrib package. ... The script "make_oidjoins_check" created ...
(Full-Disclosure)
[USN-219-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following Ubuntu 4.10 packages are affected: ... provides a new kernel. ... A local attacker could exploit this by sending an "USB ...
(Bugtraq)
[Full-disclosure] [USN-219-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following Ubuntu 4.10 packages are affected: ... provides a new kernel. ... A local attacker could exploit this by sending an "USB ...
(Full-Disclosure)
[Full-disclosure] [USN-95-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... Georgi Guninski discovered a buffer overflow in the ATM driver. ... the previous Ubuntu security update (kernel version ...
(Full-Disclosure)
[Full-disclosure] [USN-263-1] Linux kernel vulnerabilities
... Ubuntu 4.10 ... The following packages are affected: ... a local attacker could exploit this to crash the kernel. ... affects the amd64 architecture on Intel processors. ...
(Full-Disclosure)