CVE-2010-3433
Summary
| CVE | CVE-2010-3433 |
|---|---|
| State | PUBLISHED |
| Assigner | redhat |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2010-10-06 17:00:16 UTC |
| Updated | 2026-04-29 01:13:23 UTC |
| Description | The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
MediumAuthentication
SingleConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:N/AC:M/Au:S/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Postgresql | Postgresql | 7.4 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.1 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.10 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.11 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.12 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.13 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.14 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.15 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.16 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.17 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.18 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.19 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.2 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.20 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.21 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.22 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.23 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.24 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.25 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.26 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.27 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.28 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.29 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.3 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.4 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.5 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.6 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.7 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.8 | All | All | All |
| Application | Postgresql | Postgresql | 7.4.9 | All | All | All |
| Application | Postgresql | Postgresql | 8.0 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.1 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.10 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.11 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.12 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.13 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.14 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.15 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.16 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.17 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.18 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.19 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.2 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.20 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.21 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.22 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.23 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.24 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.25 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.3 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.4 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.5 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.6 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.7 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.8 | All | All | All |
| Application | Postgresql | Postgresql | 8.0.9 | All | All | All |
| Application | Postgresql | Postgresql | 8.1 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.1 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.10 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.11 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.12 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.13 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.14 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.15 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.16 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.17 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.18 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.19 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.2 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.20 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.21 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.3 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.4 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.5 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.6 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.7 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.8 | All | All | All |
| Application | Postgresql | Postgresql | 8.1.9 | All | All | All |
| Application | Postgresql | Postgresql | 8.2 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.1 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.10 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.11 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.12 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.13 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.14 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.15 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.16 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.17 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.2 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.3 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.4 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.5 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.6 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.7 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.8 | All | All | All |
| Application | Postgresql | Postgresql | 8.2.9 | All | All | All |
| Application | Postgresql | Postgresql | 8.3 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.1 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.10 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.11 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.2 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.3 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.4 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.5 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.6 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.7 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.8 | All | All | All |
| Application | Postgresql | Postgresql | 8.3.9 | All | All | All |
| Application | Postgresql | Postgresql | 8.4 | All | All | All |
| Application | Postgresql | Postgresql | 8.4.1 | All | All | All |
| Application | Postgresql | Postgresql | 8.4.2 | All | All | All |
| Application | Postgresql | Postgresql | 8.4.3 | All | All | All |
| Application | Postgresql | Postgresql | 8.4.4 | All | All | All |
| Application | Postgresql | Postgresql | 9.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| '[security bulletin] HPSBMU02781 SSRT100617 rev.1 - HP Network Node Manager i (NNMi) for HP-UX, Linux' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| USN-1002-1: PostgreSQL vulnerability | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| PostgreSQL: Documentation: Manuals: PostgreSQL 9.0: Release 9.0.1 | af854a3a-2127-422b-91ae-364da2661108 | www.postgresql.org | |
| PostgreSQL PL/Perl and PL/Tcl Local Privilege Escalation Vulnerability | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2010:019 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| Support | af854a3a-2127-422b-91ae-364da2661108 | www.redhat.com | |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | |
| USN-1002-2: PostgreSQL vulnerability | Ubuntu | af854a3a-2127-422b-91ae-364da2661108 | www.ubuntu.com | |
| Bug 639371 – CVE-2010-3433 PostgreSQL (PL/Perl, PL/Tcl): SECURITY DEFINER function keyword bypass | af854a3a-2127-422b-91ae-364da2661108 | bugzilla.redhat.com | |
| Support / Security / Advisories / / MDVSA-2010:197 | Mandriva | af854a3a-2127-422b-91ae-364da2661108 | www.mandriva.com | |
| [security-announce] SUSE Security Summary Report: SUSE-SR:2010:020 | af854a3a-2127-422b-91ae-364da2661108 | lists.opensuse.org | |
| PostgreSQL: News: PostgreSQL 2010-10-05 Security Update | af854a3a-2127-422b-91ae-364da2661108 | www.postgresql.org | Patch, Vendor Advisory |
| [SECURITY] Fedora 12 Update: postgresql-8.4.5-1.fc12 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| [SECURITY] Fedora 13 Update: postgresql-8.4.5-1.fc13 | af854a3a-2127-422b-91ae-364da2661108 | lists.fedoraproject.org | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Juniper Networks - 2015-10 Security Bulletin: CTPView: Multiple Vulnerabilities in CTPView | af854a3a-2127-422b-91ae-364da2661108 | kb.juniper.net | |
| Debian -- Security Information -- DSA-2120-1 postgresql-8.3 | af854a3a-2127-422b-91ae-364da2661108 | www.debian.org | |
| Red Hat update for postgresql - Advisories - Community | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.