Date: Sun, 29 Mar 2015 11:04:00 +0200
From: security@...driva.com
To: bugtraq@...urityfocus.com
Subject: [ MDVSA-2015:110 ] postgresql

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

 _______________________________________________________________________

 Mandriva Linux Security Advisory                         MDVSA-2015:110
 http://www.mandriva.com/en/support/security/
 _______________________________________________________________________

 Package : postgresql
 Date    : March 29, 2015
 Affected: Business Server 2.0
 _______________________________________________________________________

 Problem Description:

 Updated postgresql packages fix multiple security vulnerabilities:
 
 Granting a role without ADMIN OPTION is supposed to prevent the
 grantee from adding or removing members from the granted role, but
 this restriction was easily bypassed by doing SET ROLE first. The
 security impact is mostly that a role member can revoke the access
 of others, contrary to the wishes of his grantor. Unapproved role
 member additions are a lesser concern, since an uncooperative role
 member could provide most of his rights to others anyway by creating
 views or SECURITY DEFINER functions (CVE-2014-0060).
 
 The primary role of PL validator functions is to be called implicitly
 during CREATE FUNCTION, but they are also normal SQL functions
 that a user can call explicitly. Calling a validator on a function
 actually written in some other language was not checked for and could
 be exploited for privilege-escalation purposes. The fix involves
 adding a call to a privilege-checking function in each validator
 function. Non-core procedural languages will also need to make this
 change to their own validator functions, if any (CVE-2014-0061).
 
 If the name lookups come to different conclusions due to concurrent
 activity, we might perform some parts of the DDL on a different
 table than other parts. At least in the case of CREATE INDEX, this
 can be used to cause the permissions checks to be performed against
 a different table than the index creation, allowing for a privilege
 escalation attack (CVE-2014-0062).
 
 The MAXDATELEN constant was too small for the longest possible value of
 type interval, allowing a buffer overrun in interval_out(). Although
 the datetime input functions were more careful about avoiding buffer
 overrun, the limit was short enough to cause them to reject some valid
 inputs, such as input containing a very long timezone name. The ecpg
 library contained these vulnerabilities along with some of its own
 (CVE-2014-0063).
 
 Several functions, mostly type input functions, calculated an
 allocation size without checking for overflow. If overflow did
 occur, a too-small buffer would be allocated and then written past
 (CVE-2014-0064).
 
 Use strlcpy() and related functions to provide a clear guarantee
 that fixed-size buffers are not overrun. Unlike the preceding items,
 it is unclear whether these cases really represent live issues,
 since in most cases there appear to be previous constraints on the
 size of the input string. Nonetheless it seems prudent to silence
 all Coverity warnings of this type (CVE-2014-0065).
 
 There are relatively few scenarios in which crypt() could return NULL,
 but contrib/chkpass would crash if it did. One practical case in which
 this could be an issue is if libc is configured to refuse to execute
 unapproved hashing algorithms (e.g., FIPS mode) (CVE-2014-0066).
 
 Since the temporary server started by make check uses trust
 authentication, another user on the same machine could connect to it
 as database superuser, and then potentially exploit the privileges of
 the operating-system user who started the tests. A future release will
 probably incorporate changes in the testing procedure to prevent this
 risk, but some public discussion is needed first. So for the moment,
 just warn people against using make check when there are untrusted
 users on the same machine (CVE-2014-0067).
 
 A user with limited clearance on a table might have access to
 information in columns without SELECT rights on through server error
 messages (CVE-2014-8161).
 
 The function to_char() might read/write past the end of a buffer. This
 might crash the server when a formatting template is processed
 (CVE-2015-0241).
 
 The pgcrypto module is vulnerable to stack buffer overrun that might
 crash the server (CVE-2015-0243).
 
 Emil Lenngren reported that an attacker can inject SQL commands when
 the synchronization between client and server is lost (CVE-2015-0244).
 
 This update provides PostgreSQL versions 9.3.6 and 9.2.10 that fix
 these issues, as well as several others.
 _______________________________________________________________________

 References:

 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0060
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0061
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0062
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0063
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0064
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0065
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0066
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0067
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8161
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0241
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0242
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0243
 http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0244
 http://advisories.mageia.org/MGASA-2014-0205.html
 http://advisories.mageia.org/MGASA-2015-0069.html
 _______________________________________________________________________

 Updated Packages:

 Mandriva Business Server 2/X86_64:
 f99a635c6f82735fbc2b95e152f09efb  mbs2/x86_64/lib64ecpg9.2_6-9.2.10-1.mbs2.x86_64.rpm
 d57166faca3e9d1b932cdd43c04b4d3a  mbs2/x86_64/lib64ecpg9.3_6-9.3.6-1.mbs2.x86_64.rpm
 6e4f38d6fb5b9bb91e9f2eab3e567e1f  mbs2/x86_64/lib64pq9.2_5.5-9.2.10-1.mbs2.x86_64.rpm
 6671c3cf6916cf829c3e3bc0332190a7  mbs2/x86_64/lib64pq9.3_5-9.3.6-1.mbs2.x86_64.rpm
 eda79e884356acdd4bc3776eb9f082d7  mbs2/x86_64/postgresql9.2-9.2.10-1.mbs2.x86_64.rpm
 78ed2566f404f6af31337690f52851ca  mbs2/x86_64/postgresql9.2-contrib-9.2.10-1.mbs2.x86_64.rpm
 153a4a063504fa1fa1842b127712bfe0  mbs2/x86_64/postgresql9.2-devel-9.2.10-1.mbs2.x86_64.rpm
 9bfdccf6a88c6b13496c7da4de2bca34  mbs2/x86_64/postgresql9.2-docs-9.2.10-1.mbs2.noarch.rpm
 6b76f8d61fd457f92d90b1959fb1dea3  mbs2/x86_64/postgresql9.2-pl-9.2.10-1.mbs2.x86_64.rpm
 8526ab569ed5362fc7a92fa23dca98b6  mbs2/x86_64/postgresql9.2-plperl-9.2.10-1.mbs2.x86_64.rpm
 412cb6f09cb609fcbb09d3259f534dfc  mbs2/x86_64/postgresql9.2-plpgsql-9.2.10-1.mbs2.x86_64.rpm
 c95ce4440833dfc828c9ee8eecbcea17  mbs2/x86_64/postgresql9.2-plpython-9.2.10-1.mbs2.x86_64.rpm
 50b9c0b0197667b390ba47ccd00770d4  mbs2/x86_64/postgresql9.2-pltcl-9.2.10-1.mbs2.x86_64.rpm
 c019e6c9930eafc094f287ee7461aaaa  mbs2/x86_64/postgresql9.2-server-9.2.10-1.mbs2.x86_64.rpm
 d2a51e59c752f3ddb3ea6c77f7502433  mbs2/x86_64/postgresql9.3-9.3.6-1.mbs2.x86_64.rpm
 60e543ac5e51171e6669e68b0a5a2eb3  mbs2/x86_64/postgresql9.3-contrib-9.3.6-1.mbs2.x86_64.rpm
 483126b5d66cd0f375ec9732677b2808  mbs2/x86_64/postgresql9.3-devel-9.3.6-1.mbs2.x86_64.rpm
 0b361bfcbc87273de585f3f9c4c6a618  mbs2/x86_64/postgresql9.3-docs-9.3.6-1.mbs2.noarch.rpm
 357b9a02ee0271876013e2db04025721  mbs2/x86_64/postgresql9.3-pl-9.3.6-1.mbs2.x86_64.rpm
 7bd4f962c795ee04836f1e162c1e6b7e  mbs2/x86_64/postgresql9.3-plperl-9.3.6-1.mbs2.x86_64.rpm
 66e4b7668e00e0d16d6570ea7f1651fa  mbs2/x86_64/postgresql9.3-plpgsql-9.3.6-1.mbs2.x86_64.rpm
 13e4930b5a0dbe06a5b886a83401470a  mbs2/x86_64/postgresql9.3-plpython-9.3.6-1.mbs2.x86_64.rpm
 32e568d9ba610c58e6587b04d4cdb6ab  mbs2/x86_64/postgresql9.3-pltcl-9.3.6-1.mbs2.x86_64.rpm
 0b8899321e95fd17fc6aa954fb450a0d  mbs2/x86_64/postgresql9.3-server-9.3.6-1.mbs2.x86_64.rpm 
 f5856e921124345cf4dbadd41bfaab9d  mbs2/SRPMS/postgresql9.2-9.2.10-1.mbs2.src.rpm
 ca1994bd36f7310b82ec57914dd8496d  mbs2/SRPMS/postgresql9.3-9.3.6-1.mbs2.src.rpm
 _______________________________________________________________________

 To upgrade automatically use MandrivaUpdate or urpmi.  The verification
 of md5 checksums and GPG signatures is performed automatically for you.

 All packages are signed by Mandriva for security.  You can obtain the
 GPG public key of the Mandriva Security Team by executing:

  gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

 You can view other update advisories for Mandriva Linux at:

  http://www.mandriva.com/en/support/security/advisories/

 If you want to report vulnerabilities, please contact

  security_(at)_mandriva.com
 _______________________________________________________________________

 Type Bits/KeyID     Date       User ID
 pub  1024D/22458A98 2000-07-10 Mandriva Security Team
  <security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.12 (GNU/Linux)

iD8DBQFVF7IDmqjQ0CJFipgRAgBlAKDN/FNh6U1fh0mOBPlEu4D3BPRj/ACdGjDR
xpQfI5PlLPp20JxyU8YdeLE=
=QEFG
-----END PGP SIGNATURE-----

Powered by blists - more mailing lists