cpet/openbsd-ports
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Security update to PostgreSQL version 8.1.3.

Browse Source 
Vulnerabilities in PostgreSQL SET ROLE/SET SESSION AUTHORIZATION

By issuing SET ROLE with a specially crafted argument, it is possible
for any logged-in database user to acquire the privileges of any other
database user, including superusers.  Database superuser status allows
access to the machine's filesystem and hence might be used to mount
remote attacks against the rest of the server's operating system.
This error exists in PostgreSQL releases 8.1.0 - 8.1.2 and is fixed in 8.1.3.

The same underlying bug exists in SET SESSION AUTHORIZATION in all
releases back to 7.3.  This variant cannot be exploited for privilege
escalation, because one must already be superuser to use SET SESSION
AUTHORIZATION.  However, if the server has been compiled with Asserts
enabled (which is not the default), then it is possible to trigger an
Assert failure before the privilege check is reached.  This would cause
a momentary denial of service to other database users.  This is repaired
in PostgreSQL releases 8.1.3, 8.0.7, 7.4.12, and 7.3.14.
This commit is contained in:
mbalmer 2006-02-14 18:59:36 +00:00
parent f3921d33d6
commit 2c2240c2f4
3 changed files with 11 additions and 7 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
databases/postgresql/Makefile
View File

@ -1,10 +1,10 @@
# $OpenBSD: Makefile,v 1.84 2006/02/05 09:23:22 mbalmer Exp $
# $OpenBSD: Makefile,v 1.85 2006/02/14 18:59:36 mbalmer Exp $
COMMENT= "PostgreSQL RDBMS (client)"
COMMENT-server= "PostgreSQL RDBMS (server)"
COMMENT-docs= "PostgreSQL RDBMS documentation"
VERSION= 8.1.2
VERSION= 8.1.3
DISTNAME= postgresql-${VERSION}
FULLPKGNAME= postgresql-client-${VERSION}
PKGNAME-server= postgresql-server-${VERSION}

8
databases/postgresql/distinfo
View File

@ -1,4 +1,4 @@
MD5 (postgresql-8.1.2.tar.gz) = 17ab8d3209f81d57222cbb0e2382de8b
RMD160 (postgresql-8.1.2.tar.gz) = 98b9c376f89c4f498b57c99233aba4ac4111ab3c
SHA1 (postgresql-8.1.2.tar.gz) = 338e43fec64263dfdf03b236a214d89ce7eb8ff0
SIZE (postgresql-8.1.2.tar.gz) = 14503685
MD5 (postgresql-8.1.3.tar.gz) = 44ba19571f3ea0ae459eaf47e4daa314
RMD160 (postgresql-8.1.3.tar.gz) = 72b8ab33c24a019f298ee03b9c71d8bd34a1107e
SHA1 (postgresql-8.1.3.tar.gz) = ceb060b71e8d6c8ac539f028597a62116d9861da
SIZE (postgresql-8.1.3.tar.gz) = 14525885

6
databases/postgresql/pkg/PLIST-docs
View File

@ -1,4 +1,4 @@
@comment $OpenBSD: PLIST-docs,v 1.22 2006/02/05 09:23:22 mbalmer Exp $
@comment $OpenBSD: PLIST-docs,v 1.23 2006/02/14 18:59:37 mbalmer Exp $
share/doc/postgresql/
share/doc/postgresql/COPYRIGHT
share/doc/postgresql/FAQ
@ -389,6 +389,7 @@ share/doc/postgresql/html/release-7-3-10.html
share/doc/postgresql/html/release-7-3-11.html
share/doc/postgresql/html/release-7-3-12.html
share/doc/postgresql/html/release-7-3-13.html
share/doc/postgresql/html/release-7-3-14.html
share/doc/postgresql/html/release-7-3-2.html
share/doc/postgresql/html/release-7-3-3.html
share/doc/postgresql/html/release-7-3-4.html
@ -401,6 +402,7 @@ share/doc/postgresql/html/release-7-3.html
share/doc/postgresql/html/release-7-4-1.html
share/doc/postgresql/html/release-7-4-10.html
share/doc/postgresql/html/release-7-4-11.html
share/doc/postgresql/html/release-7-4-12.html
share/doc/postgresql/html/release-7-4-2.html
share/doc/postgresql/html/release-7-4-3.html
share/doc/postgresql/html/release-7-4-4.html
@ -416,8 +418,10 @@ share/doc/postgresql/html/release-8-0-3.html
share/doc/postgresql/html/release-8-0-4.html
share/doc/postgresql/html/release-8-0-5.html
share/doc/postgresql/html/release-8-0-6.html
share/doc/postgresql/html/release-8-0-7.html
share/doc/postgresql/html/release-8-0.html
share/doc/postgresql/html/release-8-1-1.html
share/doc/postgresql/html/release-8-1-2.html
share/doc/postgresql/html/release-8-1.html
share/doc/postgresql/html/release.html
share/doc/postgresql/html/resources.html