postgresql-8.4.20-1.AXS4
エラータID: AXSA:2014-004:01
リリース日:
2014/03/04 Tuesday - 19:34
題名:
postgresql-8.4.20-1.AXS4
影響のあるチャネル:
Asianux Server 4 for x86_64
Asianux Server 4 for x86
Severity:
High
Description:
以下項目について対処しました。
[Security Fix]
- PostgreSQL は backend/utils/adt/enum.c の enum_recv 関数を適切に宣言しておらず，そのことにより誤った引数で呼び出され，リモートの認証されたユーザがサービス拒否 (サーバのクラッシュ) を引き起こしたり，SQL コマンド経由で機密情報を含むプロセスメモリを読み取り，配列インデックスエラーや領域外の読み込みを引き起こす脆弱性があります。
(CVE-2013-0255)
- PostgreSQL が OpenSSL を使用している場合，不十分な乱数を生成し，"contrib/pgcrypto functions" に関連した要因によって，リモートの認証されたユーザが詳細不明な影響を与える脆弱性があります。(CVE-2013-1900)
現時点では CVE-2014-0060, CVE-2014-0061, CVE-2014-0062, CVE-2014-0063, CVE-2014-0064, CVE-2014-0065, CVE-2014-0066 の情報が公開されておりません。
CVE の情報が公開され次第情報をアップデートいたします。
一部CVEの翻訳文はJVNからの引用になります。
http://jvndb.jvn.jp/
解決策:
パッケージをアップデートしてください。
CVE:
CVE-2013-0255
PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.
PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.
CVE-2013-1900
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."
PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow remote authenticated users to have an unspecified impact via vectors related to the "contrib/pgcrypto functions."
CVE-2014-0061
The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.
The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to gain privileges via a function that is (1) defined in another language or (2) not allowed to be directly called by the user due to permissions.
CVE-2014-0062
Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.
Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.
CVE-2014-0063
Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.
Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.
CVE-2014-0064
Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.
Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, which trigger a buffer overflow. NOTE: this identifier has been SPLIT due to different affected versions; use CVE-2014-2669 for the hstore vector.
CVE-2014-0065
Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063.
Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact and attack vectors, a different vulnerability than CVE-2014-0063.
CVE-2014-0066
The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.
The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of the crypt library function, which allows remote authenticated users to cause a denial of service (NULL pointer dereference and crash) via unspecified vectors.
追加情報:
N/A
ダウンロード:
SRPMS
- postgresql-8.4.20-1.AXS4.src.rpm
MD5: 0e1b7d2c16190ddb281c53d8876c3c72
SHA-256: ef7bd4cdbba524520cb3eb3d55f189af7719c25b87a4f79efb31df17d9e90fbd
Size: 20.57 MB
Asianux Server 4 for x86
- postgresql-8.4.20-1.AXS4.i686.rpm
MD5: 8793b815ea4afa897f1914c2a0aeefc7
SHA-256: 89f5159a49f8244f3285efeecdd642d0b78232070fb462cc31d917e1a8998833
Size: 2.58 MB - postgresql-contrib-8.4.20-1.AXS4.i686.rpm
MD5: c19abc57d44aa7797291ca47a6299f3c
SHA-256: eb7bc5ed35601f9ce9645d9dab80676f066e98f0739e5c01538dcb7c897e0b5d
Size: 349.86 kB - postgresql-devel-8.4.20-1.AXS4.i686.rpm
MD5: 9762e9bd8192d2f2169bf82830eff26a
SHA-256: a405334ea8f5c98c276de9b8c1a55e6c674e8f2e152c1d8426b745dab3461d6d
Size: 808.97 kB - postgresql-docs-8.4.20-1.AXS4.i686.rpm
MD5: 1c13231d16e654464d3e91dcd0b56163
SHA-256: 4e3fd88028ab7f6a3ed8ca41b2ce4dcddc6a967494dabcc81f09859dbb9d8f52
Size: 6.95 MB - postgresql-libs-8.4.20-1.AXS4.i686.rpm
MD5: 404149077c21998992f9b0ee9ec88871
SHA-256: 573ab789853ff43dac31d469e77f7b332199d91cce0f5096109bc43d100aa26b
Size: 204.41 kB - postgresql-plperl-8.4.20-1.AXS4.i686.rpm
MD5: 23e23b833228eafcf16b478a848884f3
SHA-256: 9902632e3f5c31fc2a11d0a541d32d1ba9d547818f5e3e9730960396f472b0a8
Size: 56.34 kB - postgresql-plpython-8.4.20-1.AXS4.i686.rpm
MD5: 9cd4c5740b66f2da49792f534bb87491
SHA-256: 443a5e070ac38054808117fbae6d2c96794a11452262f9efe091651241b24557
Size: 57.00 kB - postgresql-pltcl-8.4.20-1.AXS4.i686.rpm
MD5: 9649ed3b6cfde8bffbd4eebf111145ee
SHA-256: e462645f308f72ec03609c3a4fa3016e935a7c19674fedf449a434196ce383f0
Size: 45.25 kB - postgresql-server-8.4.20-1.AXS4.i686.rpm
MD5: 71a0c16097f8c63db3b4b736508556ca
SHA-256: fea81c632cca13dd0bb108b47d69ec3701fcf98face4904d6e5a7dadab91aa28
Size: 3.41 MB - postgresql-test-8.4.20-1.AXS4.i686.rpm
MD5: 9534d1c0ca370712bb90599bf5ae93cc
SHA-256: b6d7e04ab4fcb7c706d316f4c9d95769f99a29f787741d2727fdd1607359956c
Size: 1.11 MB
Asianux Server 4 for x86_64
- postgresql-8.4.20-1.AXS4.x86_64.rpm
MD5: 838f4152dc0911e9c5a87a93d4f972fa
SHA-256: 9c67bf204f281030a6dde495cb482a1da85dc67d2b6a6be41679703590aceb06
Size: 2.59 MB - postgresql-contrib-8.4.20-1.AXS4.x86_64.rpm
MD5: 2943225dab87093f8a06acaaae03eb8f
SHA-256: b00912ad7a0155047213c63d9233a7288faca3314a276e61137d6c5af122ea1f
Size: 354.46 kB - postgresql-devel-8.4.20-1.AXS4.x86_64.rpm
MD5: 10d40003c573027c052deea59393e79e
SHA-256: fdabe9470c7317370ca15fa5c157fb96f0789e71fba57dd9e5ef04110cfa5942
Size: 813.98 kB - postgresql-docs-8.4.20-1.AXS4.x86_64.rpm
MD5: c94274ee74959e8576d573caa6362e33
SHA-256: 6a7faead6117355a3c7fd965c8beabc454110d4dc396ad19a8b0e824db53c81d
Size: 6.95 MB - postgresql-libs-8.4.20-1.AXS4.x86_64.rpm
MD5: 194e17dae90836cf738618c07747bae0
SHA-256: a43c1ab59e70e8ec2e81edeb8a4ab7727cdd61bf3417ef7c04aad1cda456dcf4
Size: 200.82 kB - postgresql-plperl-8.4.20-1.AXS4.x86_64.rpm
MD5: 16322529c30ef2ec8ddb79da662682b9
SHA-256: 94dcdfdddd1fa97cc7175328c95c577c6cd04d40ca7b1d7b00052d58a19b0ff5
Size: 56.23 kB - postgresql-plpython-8.4.20-1.AXS4.x86_64.rpm
MD5: 7b6d403d9719feb1be1cf8ac0173f434
SHA-256: 9251fe2b2f3280ee5e7ab7886e92b32aacc936458a9a1a4c06a6a97bed75a5a0
Size: 57.84 kB - postgresql-pltcl-8.4.20-1.AXS4.x86_64.rpm
MD5: 5e5509459feba659cbc2fba027a7eeaf
SHA-256: 4016f6a38441160aaafff6d41567087018f3502ccb974cf1c1b6278ecf0bf737
Size: 45.00 kB - postgresql-server-8.4.20-1.AXS4.x86_64.rpm
MD5: cbcdca58d40effcc1fc2ac31a0be4649
SHA-256: c390765130ffe0df2bd9bb62036c8b9b8894592fdd63f91e066aa896b6194ec9
Size: 3.44 MB - postgresql-test-8.4.20-1.AXS4.x86_64.rpm
MD5: b05a843cca2dc9f050b6c153b2d498ab
SHA-256: 78302b7049d7bb5f02bf2b06bd6b47cb1233e0f616ead02bfd79e95b2440e92f
Size: 1.11 MB - postgresql-8.4.20-1.AXS4.i686.rpm
MD5: 8793b815ea4afa897f1914c2a0aeefc7
SHA-256: 89f5159a49f8244f3285efeecdd642d0b78232070fb462cc31d917e1a8998833
Size: 2.58 MB - postgresql-devel-8.4.20-1.AXS4.i686.rpm
MD5: 9762e9bd8192d2f2169bf82830eff26a
SHA-256: a405334ea8f5c98c276de9b8c1a55e6c674e8f2e152c1d8426b745dab3461d6d
Size: 808.97 kB - postgresql-libs-8.4.20-1.AXS4.i686.rpm
MD5: 404149077c21998992f9b0ee9ec88871
SHA-256: 573ab789853ff43dac31d469e77f7b332199d91cce0f5096109bc43d100aa26b
Size: 204.41 kB