Säkerhetsbulletin från Debian

DSA-2051-1 postgresql-8.3 -- flera sårbarheter

Rapporterat den:
2010-05-24
Berörda paket:
postgresql-8.3
Sårbara:
Ja
Referenser i säkerhetsdatabaser:
I Mitres CVE-förteckning: CVE-2010-0442, CVE-2010-1169, CVE-2010-1170, CVE-2010-1975.
Ytterligare information:

Flera lokala sårbarheter har upptäckts i PostgreSQL, en objekt-relationell SQL-databas. Projektet Common Vulnerabilities and Exposures identifierar följande problem:

  • CVE-2010-1169

    Tim Bunce upptäckte att implementationen av procedurspråket PL/Perl inte begränsar delmängden tillåten kod tillräckligt, vilket tillåter autentiserade användare att exekvera godtycklig Perl-kod.

  • CVE-2010-1170

    Tom Lane upptäckte att implementationen av procedurspråket PL/Tcl inte begränsar delmängden tillåten kod tillräckligt, vilket tillåter autentiserade användare att exekvera godtycklig Perl-kod.

  • CVE-2010-1975

    Det upptäcktes att an oprivilegierad användare kan återställa parameterinställning som endast är till för superanvändaren.

För den stabila utgåvan (Lenny) har dessa problem rättats i version 8.3.11-0lenny1. Denna uppdatering innehåller även en rättelse för CVE-2010-0442, som ursprungligen skulle ingått i nästa punktutgåva av Lenny.

För den instabila utgåvan (Sid) har dessa problem rättats i version 8.4.4-1 av postgresql-8.4.

Vi rekommenderar att ni uppgraderar era postgresql-8.3-paket.

Rättat i:

Debian GNU/Linux 5.0 (lenny)

Källkod:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11.orig.tar.gz
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1.diff.gz
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1.dsc
Arkitekturoberoende komponent:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql_8.3.11-0lenny1_all.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client_8.3.11-0lenny1_all.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib_8.3.11-0lenny1_all.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-doc-8.3_8.3.11-0lenny1_all.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-doc_8.3.11-0lenny1_all.deb
Alpha:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_alpha.deb
AMD64:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_amd64.deb
ARM:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_arm.deb
ARM EABI:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_armel.deb
HP Precision:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_hppa.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_ia64.deb
Big-endian MIPS:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_mips.deb
Little-endian MIPS:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.11-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.11-0lenny1_sparc.deb

MD5-kontrollsummor för dessa filer finns i originalbulletinen.