Debians sikkerhedsbulletin

DSA-2120-1 postgresql-8.3 -- rettighedsforøgelse

Rapporteret den:
12. okt 2010
Berørte pakker:
postgresql-8.3
Sårbar:
Ja
Referencer i sikkerhedsdatabaser:
I Mitres CVE-ordbog: CVE-2010-3433.
Yderligere oplysninger:

Tim Bunce opdagede at PostgreSQL, et databaseserverprogram, ikke på korrekt vis adskilte fortolkerne af server-side stored procedures, der kører i forskellige sikkerhedskontekster. Som følge deraf, kunne ikke-priviligerede autoriserede databasebrugere måske opnå yderligere rettigheder.

Bemærk at denne sikkerhedsopdatering måske kan påvirke tilsigtet kommunikation via globable variable mellem stored procedures. Det kan være nødvendigt at konvertere disse funktioner til at køre under sprogene plperlu eller pltclu, med database-superuser-rettigheder.

Denne sikkerhedsopdatering indeholder også ikke-relaterede fejlrettelser fra PostgreSQL 8.3.12.

I den stabile distribution (lenny), er dette problem rettet i version 8.3_8.3.12-0lenny1.

I den ustabile distribution (sid), er dette problem rettet i version 8.4.5-1 af pakken postgresql-8.4.

Vi anbefaler at du opgraderer dine PostgreSQL-pakker.

Rettet i:

Debian GNU/Linux 5.0 (lenny)

Kildekode:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1.dsc
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12.orig.tar.gz
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1.diff.gz
Arkitekturuafhængig komponent:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-doc_8.3.12-0lenny1_all.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib_8.3.12-0lenny1_all.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-doc-8.3_8.3.12-0lenny1_all.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql_8.3.12-0lenny1_all.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client_8.3.12-0lenny1_all.deb
Alpha:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_alpha.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_alpha.deb
AMD64:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_amd64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_amd64.deb
ARM:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_arm.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_arm.deb
ARM EABI:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_armel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_armel.deb
HP Precision:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_hppa.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_hppa.deb
Intel IA-32:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_i386.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_i386.deb
Intel IA-64:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_ia64.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_ia64.deb
Big-endian MIPS:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_mips.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_mips.deb
Little-endian MIPS:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_mipsel.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_mipsel.deb
PowerPC:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_powerpc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_powerpc.deb
IBM S/390:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_s390.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_s390.deb
Sun Sparc:
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-pltcl-8.3_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-dev_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plpython-8.3_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client-8.3_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq-dev_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg6_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib-8.3_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpgtypes3_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-plperl-8.3_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libecpg-compat3_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-server-dev-8.3_8.3.12-0lenny1_sparc.deb
http://security.debian.org/pool/updates/main/p/postgresql-8.3/libpq5_8.3.12-0lenny1_sparc.deb

MD5-kontrolsummer for de listede filer findes i den originale sikkerhedsbulletin.