PostgreSQL Postmaster Denial Of Service Vulnerability

Bugtraq ID:	16201
Class:	Failure to Handle Exceptional Conditions
CVE:	CVE-2006-0105
Remote:	Yes
Local:	No
Published:	Jan 10 2006 12:00AM
Updated:	Jan 11 2006 04:50PM
Credit:	This issue was disclosed by the vendor. The vendor credits Yoshiyuki Asaba with the discovery of this vulnerability.
Vulnerable:	PostgreSQL PostgreSQL 8.0.2 + Trustix Secure Linux 2.2 PostgreSQL PostgreSQL 8.0.1 PostgreSQL PostgreSQL 8.0 + Trustix Secure Linux 2.2 PostgreSQL PostgreSQL 7.4.9 PostgreSQL PostgreSQL 7.4.8 PostgreSQL PostgreSQL 7.4.7 + Gentoo Linux + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + Trustix Secure Linux 2.1 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 PostgreSQL PostgreSQL 7.4.6 + Trustix Secure Linux 2.1 PostgreSQL PostgreSQL 7.4.5 + Turbolinux Appliance Server 1.0 Workgroup Edition + Turbolinux Appliance Server 1.0 Hosting Edition + Turbolinux Appliance Server Hosting Edition 1.0 + Turbolinux Appliance Server Workgroup Edition 1.0 + Turbolinux Home + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 9.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 7.0 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 PostgreSQL PostgreSQL 7.4.3 PostgreSQL PostgreSQL 7.4 PostgreSQL PostgreSQL 7.3.9 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 PostgreSQL PostgreSQL 7.3.8 + Trustix Secure Linux 2.0 PostgreSQL PostgreSQL 7.3.6 PostgreSQL PostgreSQL 7.3.4 + OpenPKG OpenPKG Current PostgreSQL PostgreSQL 7.3.3 + OpenPKG OpenPKG Current PostgreSQL PostgreSQL 7.3.2 PostgreSQL PostgreSQL 7.3.1 + OpenPKG OpenPKG 1.2 PostgreSQL PostgreSQL 7.3 PDGSoft Shopping Cart 8.1
Not Vulnerable:	PDGSoft Shopping Cart 8.1.2 PDGSoft Shopping Cart 8.0.6

PostgreSQL Postmaster Denial Of Service Vulnerability

PostgreSQL is prone to a denial of service vulnerability. This issue is due to a failure in the application to properly handle exceptional conditions.

A remote attacker can exploit this issue to crash the postmaster service, thus denying future connections until the service is manually restarted.

This issue only affects PostgreSQL for Microsoft Windows.

PostgreSQL Postmaster Denial Of Service Vulnerability

No exploit is required.

PostgreSQL Postmaster Denial Of Service Vulnerability

Solution:
The vendor has released updated versions addressing this issue:


PostgreSQL PostgreSQL 8.0

• PostgreSQL postgresql-8.0.6.tar.gz
  http://wwwmaster.postgresql.org/download/mirrors-ftp?file=source/v8.0. 6/postgresql-8.0.6.tar.gz

PostgreSQL PostgreSQL 8.0.1

• PostgreSQL postgresql-8.0.6.tar.gz
  http://wwwmaster.postgresql.org/download/mirrors-ftp?file=source/v8.0. 6/postgresql-8.0.6.tar.gz

PostgreSQL PostgreSQL 8.0.2

• PostgreSQL postgresql-8.0.6.tar.gz
  http://wwwmaster.postgresql.org/download/mirrors-ftp?file=source/v8.0. 6/postgresql-8.0.6.tar.gz

PDGSoft Shopping Cart 8.1

• PostgreSQL postgresql-8.1.2.tar.gz
  http://wwwmaster.postgresql.org/download/mirrors-ftp?file=source/v8.1. 2/postgresql-8.1.2.tar.gz

PostgreSQL Postmaster Denial Of Service Vulnerability

References:

• Minor Versions 8.1.2, 8.0.6 Released (PostgreSQL)
  
• PostgreSQL Project Homepage (PostgreSQL)
  
• PostgreSQL security releases 8.0.6 and 8.1.2 (PostgreSQL Security )