Date: Wed, 25 Apr 2007 18:59:21 -0600
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDKSA-2007:094 ] - Updated postgresql packages fix vulnerability


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________
 
 Mandriva Linux Security Advisory                         MDKSA-2007:094
 http://www.mandriva.com/security/
 _______________________________________________________________________
 
 Package : postgresql
 Date    : April 25, 2007
 Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0
 _______________________________________________________________________
 
 Problem Description:
 
 A weakness in previous versions of PostgreSQL was found in the security
 definer functions in which an authenticated but otherwise unprivileged
 SQL user could use temporary objects to execute arbitrary code with
 the privileges of the security-definer function.
 
 IMPORTANT NOTICE FOR CORPORATE SERVER/DESKTOP 3.0 USERS:
 
 In addition, packages for Corporate Server/Desktop 3.0 have been
 updated to the latest PostgreSQL 7.4.17 which requires some attention
 when upgrading.  To take advantage of the new version, and to ensure
 data coherency, we strongly recommend dumping the old databases,
 re-initializing the database, and then reloading the dumped data.
 This can be accomplished as root using:
 
  # service postgresql start
  # su - postgres
  $ pg_dumpall >/tmp/database.dump
  $ exit
  # service postgresql stop
  # mv /var/lib/pgsql /var/lib/pgsql.bk
  # urpmi.update -a && urpmi --auto-select
  # service postgresql start
  # service postgresql restart
  # su - postgres
  $ /usr/bin/psql -d template1 -f /tmp/database.dump
  $ exit
 
 Only Corporate Server/Desktop 3.0 requires the dump/reload steps; the
 other Mandriva Linux platforms do not require this step.  Notice that
 the double-restart of the postgresql service is in fact required.
 
 Updated packages have been patched to correct this issue.
 _______________________________________________________________________

 References:
 
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2138
 _______________________________________________________________________
 
 Updated Packages:
 
 Mandriva Linux 2007.0:
 517c0f9071eef1db7312a241b73e070a  2007.0/i586/libecpg5-8.1.9-0.1mdv2007.0.i586.rpm
 cb5a3512bac8ba30fc6bd25126e7d973  2007.0/i586/libecpg5-devel-8.1.9-0.1mdv2007.0.i586.rpm
 a2bfd8394996ba5d3f126845bd1d39a6  2007.0/i586/libpq4-8.1.9-0.1mdv2007.0.i586.rpm
 153cb0fda3a93eaf94047159db3ad02f  2007.0/i586/libpq4-devel-8.1.9-0.1mdv2007.0.i586.rpm
 cb23fbf89a08fa99c7af9295727c0f2a  2007.0/i586/postgresql-8.1.9-0.1mdv2007.0.i586.rpm
 1c03e49038d17a7940b0f82164bd51c0  2007.0/i586/postgresql-contrib-8.1.9-0.1mdv2007.0.i586.rpm
 fef94b3d46b3147a09cb4f411bce3afd  2007.0/i586/postgresql-devel-8.1.9-0.1mdv2007.0.i586.rpm
 6fa0ab68b6c4543bbafda41ffc1155a8  2007.0/i586/postgresql-docs-8.1.9-0.1mdv2007.0.i586.rpm
 f20c091179c00891eda767b44b0b2967  2007.0/i586/postgresql-pl-8.1.9-0.1mdv2007.0.i586.rpm
 1f5030079690ba65b394aa47abdb1859  2007.0/i586/postgresql-plperl-8.1.9-0.1mdv2007.0.i586.rpm
 72a62a6232a3717f14400294dcc47a80  2007.0/i586/postgresql-plpgsql-8.1.9-0.1mdv2007.0.i586.rpm
 51c8d98ece4ef4458cea22c62507f6f7  2007.0/i586/postgresql-plpython-8.1.9-0.1mdv2007.0.i586.rpm
 d60056d27325176ebc461e904f4684a6  2007.0/i586/postgresql-pltcl-8.1.9-0.1mdv2007.0.i586.rpm
 eb8977e8b9faa6cf36396b3f33612bcb  2007.0/i586/postgresql-server-8.1.9-0.1mdv2007.0.i586.rpm
 28efd3e89e067cd5b68d3f61cd4b31e8  2007.0/i586/postgresql-test-8.1.9-0.1mdv2007.0.i586.rpm 
 604ab4c1eff9169d56d43b0568753d0c  2007.0/SRPMS/postgresql-8.1.9-0.1mdv2007.0.src.rpm

 Mandriva Linux 2007.0/X86_64:
 956402065653e2a9785ae104e0dc06ab  2007.0/x86_64/lib64ecpg5-8.1.9-0.1mdv2007.0.x86_64.rpm
 91bdb9081eaed193022182145efc62a5  2007.0/x86_64/lib64ecpg5-devel-8.1.9-0.1mdv2007.0.x86_64.rpm
 600f760d422ff727cbc69057e15aa9a3  2007.0/x86_64/lib64pq4-8.1.9-0.1mdv2007.0.x86_64.rpm
 8cd8c17a22440ee52aabcca214d24c93  2007.0/x86_64/lib64pq4-devel-8.1.9-0.1mdv2007.0.x86_64.rpm
 46a5faf0211731467ed7dbf1c890f946  2007.0/x86_64/postgresql-8.1.9-0.1mdv2007.0.x86_64.rpm
 38369d3fb261f3bc18c4ace02ef9e6a2  2007.0/x86_64/postgresql-contrib-8.1.9-0.1mdv2007.0.x86_64.rpm
 60719dbcdb0554cdb0086d4fb9c62339  2007.0/x86_64/postgresql-devel-8.1.9-0.1mdv2007.0.x86_64.rpm
 87b08466fd00a86aae809df4fb7924b2  2007.0/x86_64/postgresql-docs-8.1.9-0.1mdv2007.0.x86_64.rpm
 269cb2eb609009b984fbea3617f336d5  2007.0/x86_64/postgresql-pl-8.1.9-0.1mdv2007.0.x86_64.rpm
 b40470ee91762d039592acf38575a00e  2007.0/x86_64/postgresql-plperl-8.1.9-0.1mdv2007.0.x86_64.rpm
 4457df5483f614c76705635ef5c0ac4b  2007.0/x86_64/postgresql-plpgsql-8.1.9-0.1mdv2007.0.x86_64.rpm
 dcfec6ba4550a20ac2e0802aaa1c8494  2007.0/x86_64/postgresql-plpython-8.1.9-0.1mdv2007.0.x86_64.rpm
 a94b7517375b9133202504f22b8bf33e  2007.0/x86_64/postgresql-pltcl-8.1.9-0.1mdv2007.0.x86_64.rpm
 3d1ae4efa79c8d6853eb65e565aa390e  2007.0/x86_64/postgresql-server-8.1.9-0.1mdv2007.0.x86_64.rpm
 b39077e2c2c8869de50be2ca624df823  2007.0/x86_64/postgresql-test-8.1.9-0.1mdv2007.0.x86_64.rpm 
 604ab4c1eff9169d56d43b0568753d0c  2007.0/SRPMS/postgresql-8.1.9-0.1mdv2007.0.src.rpm

 Mandriva Linux 2007.1:
 3df8944a00c7c726387c7324f9815e90  2007.1/i586/libecpg5-8.2.4-0.1mdv2007.1.i586.rpm
 9123e4fcbc39c0abd1b5e0135a156ab0  2007.1/i586/libecpg5-devel-8.2.4-0.1mdv2007.1.i586.rpm
 60350e3f9a207d9439c6d8e232ed6bbd  2007.1/i586/libpq5-8.2.4-0.1mdv2007.1.i586.rpm
 478927128426902f1367dfbea504fc88  2007.1/i586/libpq5-devel-8.2.4-0.1mdv2007.1.i586.rpm
 a17e76d43c869bba5c4dc9e1629ff91d  2007.1/i586/postgresql-8.2.4-0.1mdv2007.1.i586.rpm
 179eb9d1dfcb125ccd1e569b3a92b30d  2007.1/i586/postgresql-contrib-8.2.4-0.1mdv2007.1.i586.rpm
 0a188af2e9d35040f0c8e9db571206c1  2007.1/i586/postgresql-devel-8.2.4-0.1mdv2007.1.i586.rpm
 39f48d42719454c67b9cfa85fa6e8023  2007.1/i586/postgresql-docs-8.2.4-0.1mdv2007.1.i586.rpm
 f25da3d2fd0db47de0bba8d6c1116684  2007.1/i586/postgresql-pl-8.2.4-0.1mdv2007.1.i586.rpm
 3873417cec41b3bb4a0ec8719940e3d8  2007.1/i586/postgresql-plperl-8.2.4-0.1mdv2007.1.i586.rpm
 35c93ec505a67aa46c21a206ac1eb841  2007.1/i586/postgresql-plpgsql-8.2.4-0.1mdv2007.1.i586.rpm
 0d0319c172da8873c9ad64ad0fcfc6a8  2007.1/i586/postgresql-plpython-8.2.4-0.1mdv2007.1.i586.rpm
 7ac251f460862145dd82c997b67ae669  2007.1/i586/postgresql-pltcl-8.2.4-0.1mdv2007.1.i586.rpm
 135c8bd0237ee75ff9e29d425ccbf172  2007.1/i586/postgresql-server-8.2.4-0.1mdv2007.1.i586.rpm
 0ef7f082b9ebc07608e486af4b9dd56b  2007.1/i586/postgresql-test-8.2.4-0.1mdv2007.1.i586.rpm 
 638359cb35d5a9622070499a9514eced  2007.1/SRPMS/postgresql-8.2.4-0.1mdv2007.1.src.rpm

 Mandriva Linux 2007.1/X86_64:
 5b5d13fbf6a32b4b3e911e1b5134d465  2007.1/x86_64/lib64ecpg5-8.2.4-0.1mdv2007.1.x86_64.rpm
 93d08d1eba51cff345ff9d6acb5fa796  2007.1/x86_64/lib64ecpg5-devel-8.2.4-0.1mdv2007.1.x86_64.rpm
 4380464897593e9374f7bf774c905ba6  2007.1/x86_64/lib64pq5-8.2.4-0.1mdv2007.1.x86_64.rpm
 0b3a2954c1fee9048f6ace8a626d62e8  2007.1/x86_64/lib64pq5-devel-8.2.4-0.1mdv2007.1.x86_64.rpm
 f6ae0606cd7134f068aaaf8c2fff0292  2007.1/x86_64/postgresql-8.2.4-0.1mdv2007.1.x86_64.rpm
 ee14e3acca88b4cd0d734e5397769831  2007.1/x86_64/postgresql-contrib-8.2.4-0.1mdv2007.1.x86_64.rpm
 ddeacc659f35ec9afad0dd8c21400b9f  2007.1/x86_64/postgresql-devel-8.2.4-0.1mdv2007.1.x86_64.rpm
 cbc808e7738a35e3ebd1b6991a59cb79  2007.1/x86_64/postgresql-docs-8.2.4-0.1mdv2007.1.x86_64.rpm
 c79feee4c88e60db37685365a27921a3  2007.1/x86_64/postgresql-pl-8.2.4-0.1mdv2007.1.x86_64.rpm
 61a4559ed41a5eef3bf243b5ebbd88cb  2007.1/x86_64/postgresql-plperl-8.2.4-0.1mdv2007.1.x86_64.rpm
 8d25dff12db7440d87db77b80f07c9a1  2007.1/x86_64/postgresql-plpgsql-8.2.4-0.1mdv2007.1.x86_64.rpm
 b7c817ff49998108979134c824280361  2007.1/x86_64/postgresql-plpython-8.2.4-0.1mdv2007.1.x86_64.rpm
 e032ba1974c54e5d501e4d795b6ea019  2007.1/x86_64/postgresql-pltcl-8.2.4-0.1mdv2007.1.x86_64.rpm
 12eb8f8af0436827d60f7a2e20e54ffc  2007.1/x86_64/postgresql-server-8.2.4-0.1mdv2007.1.x86_64.rpm
 38da203b39fee5d033aa8d4d271aad31  2007.1/x86_64/postgresql-test-8.2.4-0.1mdv2007.1.x86_64.rpm 
 638359cb35d5a9622070499a9514eced  2007.1/SRPMS/postgresql-8.2.4-0.1mdv2007.1.src.rpm

 Corporate 3.0:
 646d1967c7817bd3e947625e917e419a  corporate/3.0/i586/libecpg3-7.4.17-0.1.C30mdk.i586.rpm
 e6c0665d1c1f6d01fb593cea793fd21c  corporate/3.0/i586/libecpg3-devel-7.4.17-0.1.C30mdk.i586.rpm
 367a1a5e41296de44fc00c8d503b6249  corporate/3.0/i586/libpgtcl2-7.4.17-0.1.C30mdk.i586.rpm
 5bd97bab3949788023eb19c7ba2e7741  corporate/3.0/i586/libpgtcl2-devel-7.4.17-0.1.C30mdk.i586.rpm
 b6cdfd8367295ac9fa7b2f2cf6f905f9  corporate/3.0/i586/libpq3-7.4.17-0.1.C30mdk.i586.rpm
 19555e20d9aa178b51143528e77e6475  corporate/3.0/i586/libpq3-devel-7.4.17-0.1.C30mdk.i586.rpm
 f5c5a879c52f82c4b16bc938b62ee91c  corporate/3.0/i586/postgresql-7.4.17-0.1.C30mdk.i586.rpm
 03ac74dbeef39af84eec102c56976107  corporate/3.0/i586/postgresql-contrib-7.4.17-0.1.C30mdk.i586.rpm
 72556b095557727b9b0736853fae9119  corporate/3.0/i586/postgresql-devel-7.4.17-0.1.C30mdk.i586.rpm
 8e0b157624f8ebb0f3670ee72569afd8  corporate/3.0/i586/postgresql-docs-7.4.17-0.1.C30mdk.i586.rpm
 4e3edb25340151d205a424f01dcf3075  corporate/3.0/i586/postgresql-jdbc-7.4.17-0.1.C30mdk.i586.rpm
 c2eb436905577516055dd7acad6a2557  corporate/3.0/i586/postgresql-pl-7.4.17-0.1.C30mdk.i586.rpm
 d1896f68eb93440a07b873b07b86d61f  corporate/3.0/i586/postgresql-server-7.4.17-0.1.C30mdk.i586.rpm
 8e8b4827ad3e766e59e186af3413e020  corporate/3.0/i586/postgresql-tcl-7.4.17-0.1.C30mdk.i586.rpm
 109de6e1ebda4fd83a74110ca41414a9  corporate/3.0/i586/postgresql-test-7.4.17-0.1.C30mdk.i586.rpm 
 bbdbb4097ed1b4dfd5080c9f0816fbec  corporate/3.0/SRPMS/postgresql-7.4.17-0.1.C30mdk.src.rpm

 Corporate 3.0/X86_64:
 2b143feeb5d1460f147cab172706f156  corporate/3.0/x86_64/lib64ecpg3-7.4.17-0.1.C30mdk.x86_64.rpm
 32a80a738198e678841c80e4738de4c4  corporate/3.0/x86_64/lib64ecpg3-devel-7.4.17-0.1.C30mdk.x86_64.rpm
 21385b87ec19b57fcdba5377e24201d9  corporate/3.0/x86_64/lib64pgtcl2-7.4.17-0.1.C30mdk.x86_64.rpm
 5f0510dcf64dac9e17a5b441c925b6fc  corporate/3.0/x86_64/lib64pgtcl2-devel-7.4.17-0.1.C30mdk.x86_64.rpm
 e3232ef519e99c09d9dedd1f10de45de  corporate/3.0/x86_64/lib64pq3-7.4.17-0.1.C30mdk.x86_64.rpm
 9dc4969b13607f1a33ecff25e43b1935  corporate/3.0/x86_64/lib64pq3-devel-7.4.17-0.1.C30mdk.x86_64.rpm
 567b7aea6434a684998f34d9186fc6fd  corporate/3.0/x86_64/postgresql-7.4.17-0.1.C30mdk.x86_64.rpm
 1e45d7fceecfb8bf86d2744068872f19  corporate/3.0/x86_64/postgresql-contrib-7.4.17-0.1.C30mdk.x86_64.rpm
 9d490e14abd370b034bafe7a486549de  corporate/3.0/x86_64/postgresql-devel-7.4.17-0.1.C30mdk.x86_64.rpm
 e5a672ec89a58203b911de64c045f8f3  corporate/3.0/x86_64/postgresql-docs-7.4.17-0.1.C30mdk.x86_64.rpm
 21ead848412a1061b39ac086685d77b6  corporate/3.0/x86_64/postgresql-jdbc-7.4.17-0.1.C30mdk.x86_64.rpm
 530ad70509220bca3411120d0020173f  corporate/3.0/x86_64/postgresql-pl-7.4.17-0.1.C30mdk.x86_64.rpm
 de958377b2104311b8916ef16847346f  corporate/3.0/x86_64/postgresql-server-7.4.17-0.1.C30mdk.x86_64.rpm
 111f10b26fe26f15727071db0d868de0  corporate/3.0/x86_64/postgresql-tcl-7.4.17-0.1.C30mdk.x86_64.rpm
 08780f0b4793e9c40c4c666b8d13aa21  corporate/3.0/x86_64/postgresql-test-7.4.17-0.1.C30mdk.x86_64.rpm 
 bbdbb4097ed1b4dfd5080c9f0816fbec  corporate/3.0/SRPMS/postgresql-7.4.17-0.1.C30mdk.src.rpm

 Corporate 4.0:
 9d185ded15856e8aa9d29d13c393005a  corporate/4.0/i586/libecpg5-8.1.9-0.1.20060mlcs4.i586.rpm
 bf335907250df8f84abd05e7a4019efa  corporate/4.0/i586/libecpg5-devel-8.1.9-0.1.20060mlcs4.i586.rpm
 d6fc5b70aadaaa5014bb80a7a581c7d5  corporate/4.0/i586/libpq4-8.1.9-0.1.20060mlcs4.i586.rpm
 ed243f7b358a4073f88b0656c4ad2a10  corporate/4.0/i586/libpq4-devel-8.1.9-0.1.20060mlcs4.i586.rpm
 418f422c981814dbfdcfbb2333ff830a  corporate/4.0/i586/postgresql-8.1.9-0.1.20060mlcs4.i586.rpm
 74995dd790cccd97fa3a4d901d85a747  corporate/4.0/i586/postgresql-contrib-8.1.9-0.1.20060mlcs4.i586.rpm
 0f18a025f73ef5a134cae5ae079a82c6  corporate/4.0/i586/postgresql-devel-8.1.9-0.1.20060mlcs4.i586.rpm
 fb19e6d64b4c2442e09afb24029b455a  corporate/4.0/i586/postgresql-docs-8.1.9-0.1.20060mlcs4.i586.rpm
 3c901904f77b3acbc07162484a93fe95  corporate/4.0/i586/postgresql-pl-8.1.9-0.1.20060mlcs4.i586.rpm
 a8076e3bb600f7269c6c3c8dd75570ad  corporate/4.0/i586/postgresql-plperl-8.1.9-0.1.20060mlcs4.i586.rpm
 e2bb6062954a04fb8301071c276f4ce9  corporate/4.0/i586/postgresql-plpgsql-8.1.9-0.1.20060mlcs4.i586.rpm
 bee2865980ab79245f1ffcec5859afee  corporate/4.0/i586/postgresql-plpython-8.1.9-0.1.20060mlcs4.i586.rpm
 8611728b252c1850a425d1df7e959e28  corporate/4.0/i586/postgresql-pltcl-8.1.9-0.1.20060mlcs4.i586.rpm
 da191a0cc07b06c88907622e418f8edf  corporate/4.0/i586/postgresql-server-8.1.9-0.1.20060mlcs4.i586.rpm
 2f2f4910e1b1eddbc20143370d37d492  corporate/4.0/i586/postgresql-test-8.1.9-0.1.20060mlcs4.i586.rpm 
 ca8d689948255f7272231c30ac7b77e8  corporate/4.0/SRPMS/postgresql-8.1.9-0.1.20060mlcs4.src.rpm

 Corporate 4.0/X86_64:
 3a9d2c4576c880d88e745dbe483ab745  corporate/4.0/x86_64/lib64ecpg5-8.1.9-0.1.20060mlcs4.x86_64.rpm
 0fc514faf948500ec0137b44cc1a5389  corporate/4.0/x86_64/lib64ecpg5-devel-8.1.9-0.1.20060mlcs4.x86_64.rpm
 bacb4bd2566d780a8932f529440ca2ff  corporate/4.0/x86_64/lib64pq4-8.1.9-0.1.20060mlcs4.x86_64.rpm
 0cc781b80d02284b7ed02e9992eb6703  corporate/4.0/x86_64/lib64pq4-devel-8.1.9-0.1.20060mlcs4.x86_64.rpm
 d78cc609f0946a02f14afa7b966611c3  corporate/4.0/x86_64/postgresql-8.1.9-0.1.20060mlcs4.x86_64.rpm
 b1d44b41d5c530e2ed8511ff675fb4c2  corporate/4.0/x86_64/postgresql-contrib-8.1.9-0.1.20060mlcs4.x86_64.rpm
 8692be6eafa3456df3fa0a3d87de72cb  corporate/4.0/x86_64/postgresql-devel-8.1.9-0.1.20060mlcs4.x86_64.rpm
 53f92d03039e36039e3a1f72f334870f  corporate/4.0/x86_64/postgresql-docs-8.1.9-0.1.20060mlcs4.x86_64.rpm
 444849a87da50f7f0997d7bbca98eb52  corporate/4.0/x86_64/postgresql-pl-8.1.9-0.1.20060mlcs4.x86_64.rpm
 3fc7ab8ac28d455c11bd383c325f7e34  corporate/4.0/x86_64/postgresql-plperl-8.1.9-0.1.20060mlcs4.x86_64.rpm
 8d76936ae1bea76ca560f69de7f3ddbb  corporate/4.0/x86_64/postgresql-plpgsql-8.1.9-0.1.20060mlcs4.x86_64.rpm
 80d5cafaebc857bebda5c506d94d87c1  corporate/4.0/x86_64/postgresql-plpython-8.1.9-0.1.20060mlcs4.x86_64.rpm
 b9b4c5a0146c879ce50bea68441d3984  corporate/4.0/x86_64/postgresql-pltcl-8.1.9-0.1.20060mlcs4.x86_64.rpm
 ea9ca783a6c15724f19ac67b9481e7bd  corporate/4.0/x86_64/postgresql-server-8.1.9-0.1.20060mlcs4.x86_64.rpm
 b840ea84713a8e04d5344099c5f90e6b  corporate/4.0/x86_64/postgresql-test-8.1.9-0.1.20060mlcs4.x86_64.rpm 
 ca8d689948255f7272231c30ac7b77e8  corporate/4.0/SRPMS/postgresql-8.1.9-0.1.20060mlcs4.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/security/advisories

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)

iD8DBQFGL835mqjQ0CJFipgRAjiiAJ9uQ9EEMkDisMrGdi8BQCQpTJBEYACfcTpg
2BPKp+5JbNeOLrOsLTLoITY=
=XFMD
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists