PostgreSQL CVE-2015-3167 Key Enumeration Information Disclosure Vulnerability

Bugtraq ID:	74789
Class:	Design Error
CVE:	CVE-2015-3167
Remote:	Yes
Local:	No
Published:	May 22 2015 12:00AM
Updated:	Nov 03 2015 07:43PM
Credit:	Noah Misch
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop 6 Gentoo Linux Debian Linux 6.0 sparc Debian Linux 6.0 s/390 Debian Linux 6.0 powerpc Debian Linux 6.0 mips Debian Linux 6.0 ia-64 Debian Linux 6.0 ia-32 Debian Linux 6.0 arm Debian Linux 6.0 amd64 CentOS CentOS 6
Not Vulnerable:

PostgreSQL CVE-2015-3167 Key Enumeration Information Disclosure Vulnerability

PostgreSQL is prone to an information-disclosure vulnerability.

Successfully exploiting this issue may allow an attacker to obtain sensitive information that may aid in further attacks.

PostgreSQL CVE-2015-3167 Key Enumeration Information Disclosure Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

PostgreSQL CVE-2015-3167 Key Enumeration Information Disclosure Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

PostgreSQL CVE-2015-3167 Key Enumeration Information Disclosure Vulnerability

References:

• PostgreSQL 9.4.2, 9.3.7, 9.2.11, 9.1.16, and 9.0.20 released! (PostgreSQL)
  
• PostgreSQL Homepage (PostgreSQL)
  
• postgresql security update (Red Hat)
  
• postgresql92-postgresql security update (Red Hat)
  
• rh-postgresql94-postgresql security update (Red Hat)
  
• Security Bulletin: Multiple Open Source PostgreSQL vulnerabilities (CVE-2015-316 (IBM)