bugtraq - PostgreSQL security releases 8.0.6 and 8.1.2

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <43C5151E.6040507@postgresql.org>
Date: Wed, 11 Jan 2006 15:24:30 +0100
From: PostgreSQL Security <secuity@...tgresql.org>
To: bugtraq@...urityfocus.com
Subject: PostgreSQL security releases 8.0.6 and 8.1.2


PostgreSQL versions 8.0.6 and 8.1.2 have been released fixing a remote 
denial of service vulnerability on the win32 platform.


Details
-------
Vulnerability type: Denial of service
Remotely exploitable: Yes

Affected versions: PostgreSQL 8.0.0-8.0.5, 8.1.0-8.1.1 Fixed versions: 
PostgreSQL 8.0.6, 8.1.2

Affected platforms: Win32
Non-affected platforms: All non-win32, including Unix, MacOS X and Cygwin.

CVE: CVE-2006-0105 
(http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=2006-0105)


Vulnerability description
-------------------------
When the postmaster process detects too many attempted connections at 
the same time, it will incorrectly log a FATAL error and shut down. This 
will not affect existing processes, but will make it impossible to 
initiate new connections until the service is restarted.

This is a denial of service vulnerability only. As it is a standard 
emergency shutdown, it can not be exploited for remote code execution.


Solution
--------
Upgrade to version 8.0.6 or 8.1.2 respectively, available from 
http://www.postgresql.org/ftp/ in both source and binary formats.


Workarounds
-----------
Implementing proper firewalling at the network and host level will help 
mitigate this vulnerability. No other workarounds are possible.


Timeline
--------
2005-12-22 - Vulnerability reported to security@...tgresql.org
2005-12-23 - Patch created
2006-01-06 - Patch applied to main tree and new versions packaged
2006-01-09 - New versions announced


Credits
-------
The PostgreSQL Global Development Group thanks Yoshiyuki Asaba for 
reporting this vulnerability.