BID:16650

PostgreSQL Set Session Authorization Denial of Service Vulnerability

Info

PostgreSQL Set Session Authorization Denial of Service Vulnerability

Bugtraq ID:	16650
Class:	Unknown
CVE:	CVE-2006-0678
Remote:	Yes
Local:	No
Published:	Feb 14 2006 12:00AM
Updated:	Dec 22 2006 12:04AM
Credit:	Akio Ishida is credited with the discovery of this vulnerability.
Vulnerable:	Ubuntu Ubuntu Linux 5.10 powerpc Ubuntu Ubuntu Linux 5.10 i386 Ubuntu Ubuntu Linux 5.10 amd64 Trustix Secure Linux 3.0 Trustix Secure Linux 2.2 Trustix Secure Enterprise Linux 2.0 PostgreSQL PostgreSQL 8.1.1 PostgreSQL PostgreSQL 8.0.5 PostgreSQL PostgreSQL 8.0.4 PostgreSQL PostgreSQL 8.0.3 PostgreSQL PostgreSQL 8.0.2 + Trustix Secure Linux 2.2 PostgreSQL PostgreSQL 8.0.1 PostgreSQL PostgreSQL 8.0 + Trustix Secure Linux 2.2 PostgreSQL PostgreSQL 7.4.11 PostgreSQL PostgreSQL 7.4.10 PostgreSQL PostgreSQL 7.4.9 PostgreSQL PostgreSQL 7.4.8 PostgreSQL PostgreSQL 7.4.7 + Gentoo Linux + S.u.S.E. Linux Personal 9.2 x86_64 + S.u.S.E. Linux Personal 9.2 + S.u.S.E. Linux Personal 9.1 x86_64 + S.u.S.E. Linux Personal 9.1 + Trustix Secure Linux 2.1 + Ubuntu Ubuntu Linux 5.0 4 powerpc + Ubuntu Ubuntu Linux 5.0 4 i386 + Ubuntu Ubuntu Linux 5.0 4 amd64 PostgreSQL PostgreSQL 7.4.6 + Trustix Secure Linux 2.1 PostgreSQL PostgreSQL 7.4.5 + Turbolinux Appliance Server 1.0 Workgroup Edition + Turbolinux Appliance Server 1.0 Hosting Edition + Turbolinux Appliance Server Hosting Edition 1.0 + Turbolinux Appliance Server Workgroup Edition 1.0 + Turbolinux Home + Turbolinux Turbolinux Desktop 10.0 + Turbolinux Turbolinux Server 10.0 + Turbolinux Turbolinux Server 9.0 + Turbolinux Turbolinux Server 8.0 + Turbolinux Turbolinux Server 7.0 + Turbolinux Turbolinux Workstation 8.0 + Turbolinux Turbolinux Workstation 7.0 + Ubuntu Ubuntu Linux 4.1 ppc + Ubuntu Ubuntu Linux 4.1 ia64 + Ubuntu Ubuntu Linux 4.1 ia32 PostgreSQL PostgreSQL 7.4.4 PostgreSQL PostgreSQL 7.4.3 PostgreSQL PostgreSQL 7.4.2 PostgreSQL PostgreSQL 7.4.1 PostgreSQL PostgreSQL 7.4 PostgreSQL PostgreSQL 7.3.13 PostgreSQL PostgreSQL 7.3.12 PostgreSQL PostgreSQL 7.3.11 PostgreSQL PostgreSQL 7.3.10 PostgreSQL PostgreSQL 7.3.9 + Redhat Desktop 3.0 + Redhat Enterprise Linux AS 3 + Redhat Enterprise Linux ES 3 + Redhat Enterprise Linux WS 3 + S.u.S.E. Linux Personal 9.0 x86_64 + S.u.S.E. Linux Personal 9.0 + S.u.S.E. Linux Personal 8.2 PostgreSQL PostgreSQL 7.3.8 + Trustix Secure Linux 2.0 PostgreSQL PostgreSQL 7.3.6 PostgreSQL PostgreSQL 7.3.4 + OpenPKG OpenPKG Current PostgreSQL PostgreSQL 7.3.3 + OpenPKG OpenPKG Current PostgreSQL PostgreSQL 7.3.2 PostgreSQL PostgreSQL 7.3.1 + OpenPKG OpenPKG 1.2 PostgreSQL PostgreSQL 7.3 PDGSoft Shopping Cart 8.1.2 PDGSoft Shopping Cart 8.1 PDGSoft Shopping Cart 8.0.6

Not Vulnerable:	PostgreSQL PostgreSQL 8.1.3 PostgreSQL PostgreSQL 8.0.7 PostgreSQL PostgreSQL 7.4.12 PostgreSQL PostgreSQL 7.3.14

Discussion

PostgreSQL Set Session Authorization Denial of Service Vulnerability

PostgreSQL is prone to a remote denial-of-service vulnerability.

An attacker can exploit this issue to cause a loss of service to other database users. Repeated attacks will result in a prolonged denial-of-service condition.

Successful exploitation of this issue requires that the application be compiled with 'Asserts' enabled; this is not the default setting.

Exploit / POC

PostgreSQL Set Session Authorization Denial of Service Vulnerability

An exploit is not required.

Solution / Fix

PostgreSQL Set Session Authorization Denial of Service Vulnerability

Solution:
The vendor has released an advisory along with fixes to address this issue. Please see the referenced advisories for more information.

PostgreSQL PostgreSQL 7.3