This update fixes the following problems:
CVE-2007-0555 and CVE-2007-0556. Both of these issues
allow an authenticated attacker with the permissions to run arbitrary SQL to
launch a denial-of-service attack or possibly read out random chunks of
memory. Since attacks to require authenticated access, the security hole is
only considered medium risk. You can read more about the issues on Mitre:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0555http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0556
Vulnerabilities in PostgreSQL SET ROLE/SET SESSION AUTHORIZATION
By issuing SET ROLE with a specially crafted argument, it is possible
for any logged-in database user to acquire the privileges of any other
database user, including superusers. Database superuser status allows
access to the machine's filesystem and hence might be used to mount
remote attacks against the rest of the server's operating system.
This error exists in PostgreSQL releases 8.1.0 - 8.1.2 and is fixed in 8.1.3.
The same underlying bug exists in SET SESSION AUTHORIZATION in all
releases back to 7.3. This variant cannot be exploited for privilege
escalation, because one must already be superuser to use SET SESSION
AUTHORIZATION. However, if the server has been compiled with Asserts
enabled (which is not the default), then it is possible to trigger an
Assert failure before the privilege check is reached. This would cause
a momentary denial of service to other database users. This is repaired
in PostgreSQL releases 8.1.3, 8.0.7, 7.4.12, and 7.3.14.
server package, so that the informationis always available and not only
when the docs package is installed. This was requested by many people.
SECURITY:
Version 8.1.2 fixes security and other problems that were present in 8.1.0.
See http://archives.postgresql.org/pgsql-announce/2006-01/msg00001.php for
details.
As noted on ports@ recently, pkg_add -r relies on conflicts, and the
sheer existence of updates means we MUST take the past into account in
conflicts now.
Note the renaming of hugs98 to valid package names where versions are
concerned.
This commit shows clearly the renaming of the xfce4 plugin packages, the
ditching of eclipse flavors, the splitting of nessus into subpackages,
the splitting of various other software documentations, some packaging bugs
in kdeedu, and a lot of files moving around...
okay pvalchev@
Changes in the package layout means that there is now a -client and
-server subpackage, and users no longer need to decide which, as
the -server depends on the -client, just like the sane cases in
mysql and openldap.
Other changes include:
* Removal of the tcl FLAVOR until someone with more tcl/tk knowledge
can make it work correctly.
* The INSTALL-server script now created a _postgresql user and group
if they don't already exist, and also a default database in
/var/postgresql if that directory also doesn't exist.
* The port is marked for NO_SHARED_ARCHS as the -server subpackage
needs shared lib support to build.
* The port will build with spinlocks disabled on hppa until someone
can check and test this problem more closely.
Built and checked on i386, sparc64, amd64, macppc (waiting for regress
test feedback).
Dependent packages will be updated after this commit, shortly.
- .else if -> .elif
- remove unnecessary symlinks used on "other" ELF-based systems which were
intentionally removed awhile back
--
Ok'd by: Brandon Palmer <bpalmer@crimelabs.net>
* The package is now called `postgresql' and not `pgsql'.
* The default user that is suggested for the admin account is also
`postgresql'. This will work with OpenBSD-current with long username
support. If anything breaks please report to the maintainers.
* pgwrap is no longer shipped or supported
* Please note, you will HAVE TO BACKUP your old data if you are
upgrading from a previous release of postgresql. Do this before
removing the old pgsql package.
From the announcement last weekend:
Key New Features and Capabilities of Version 7.1 Include:
* Write-ahead Log (WAL) increases data integrity and processing
speed. To maintain database consistency in case of an operating
system crash, previous releases of PostgreSQL have forced all all
data modifications to disk before each transaction commit. With
WAL, only one log file must be flushed to disk, greatly improving
performance. (Tech note: can eliminate use of -F in to disable disk
flushes)
* TOAST (The Oversized-Attribute Storage Technique) Past releases
had compiled-in row length limit typically between 8Kb & 32Kb. This
restriction made storage of long text fields difficult, cumbersome
and slow. TOAST enables rows of any length while maintaing the high
performance PostgreSQL users have come to expect.
* SQL92 Outer Joins are now supported. (Tech note: eliminates the
UNION/NOT IN workaround)
* 64-bit C Language Function Manager support The previous C function
manager did not handle support 64-bit CPU's (e.g. Alpha, Sun,
Itanium). (Tech note: This change should not impact existing custom
functions developed for past versions, but performance will be
improved through rewriting to use the new call interface.)
* Complex Queries that are better, stronger and faster Many complex
queries were unsupported in previous releases. With v7.1 combinations
of views, aggregates, UNION, LIMIT, cursors, subqueries, and inherited
tables are enabled. Inherited tables are now accessed by default,
and subqueries in FROM are now supported.
