Sicherheit: Zwei Probleme in postgresql

Lesezeichen hinzufügen

This is a multi-part message in MIME format...

------------=_1170821862-16192-9192

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

_______________________________________________________________________

Mandriva Linux Security Advisory MDKSA-2007:037
http://www.mandriva.com/security/
_______________________________________________________________________

Package : postgresql
Date : February 6, 2007
Affected: 2006.0, 2007.0, Corporate 3.0, Corporate 4.0
_______________________________________________________________________

Problem Description:

Jeff Trout discovered that the PostgreSQL server did not sufficiently
check data types of SQL function arguments in some cases. A user could
then exploit this to crash the database server or read out arbitrary
locations of the server's memory, which could be used to retrieve
database contents that the user should not be able to see. Note that a
user must be authenticated in order to exploit this (CVE-2007-0555).

As well, Jeff Trout also discovered that the query planner did not
verify that a table was still compatible with a previously-generated
query plan, which could be exploted to read out arbitrary locations of
the server's memory by using ALTER COLUMN TYPE during query execution.
Again, a user must be authenticated in order to exploit this
(CVE-2007-0556).

Updated packages have been patched to correct these issues.
_______________________________________________________________________

References:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0555
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-0556
_______________________________________________________________________

Updated Packages:

Mandriva Linux 2006.0:
e60813d14a97195111e2f441c035c0a4
2006.0/i586/libecpg5-8.0.11-0.1.20060mdk.i586.rpm
98471eae4a56f506629b7b78858df05b
2006.0/i586/libecpg5-devel-8.0.11-0.1.20060mdk.i586.rpm
649d620612706f772506250aa074f105
2006.0/i586/libpq4-8.0.11-0.1.20060mdk.i586.rpm
33be3c14364154f423ef63d1bbef52ed
2006.0/i586/libpq4-devel-8.0.11-0.1.20060mdk.i586.rpm
4c9ed409c90110a0b22d6faf3a3c0fcd
2006.0/i586/postgresql-8.0.11-0.1.20060mdk.i586.rpm
072d1dc81f3a430c76b0a2e2c9f2b9bc
2006.0/i586/postgresql-contrib-8.0.11-0.1.20060mdk.i586.rpm
ecc54ed5ec7bdab8fdbfc19eff109703
2006.0/i586/postgresql-devel-8.0.11-0.1.20060mdk.i586.rpm
c46c90969f5322c37ecb58fce0aadaac
2006.0/i586/postgresql-docs-8.0.11-0.1.20060mdk.i586.rpm
e788e7e5036e49ff126ef0dd1264f72c
2006.0/i586/postgresql-jdbc-8.0.11-0.1.20060mdk.i586.rpm
da908fc8bea59bdab1ec5bd75bc71aa3
2006.0/i586/postgresql-pl-8.0.11-0.1.20060mdk.i586.rpm
3689716149fd60406f71ce6371c4994a
2006.0/i586/postgresql-plperl-8.0.11-0.1.20060mdk.i586.rpm
cd28d3b208ad2fd90ccb0ee7b26acd73
2006.0/i586/postgresql-plpgsql-8.0.11-0.1.20060mdk.i586.rpm
85fe6864b2ab743023a0b3f9ef055dba
2006.0/i586/postgresql-plpython-8.0.11-0.1.20060mdk.i586.rpm
b09b01ee09433cb2276694c1a7769a58
2006.0/i586/postgresql-pltcl-8.0.11-0.1.20060mdk.i586.rpm
3ee91ea236e04f2a911ad69868bf3f29
2006.0/i586/postgresql-server-8.0.11-0.1.20060mdk.i586.rpm
d5d9d33f248cadef71bff48dd1f7c81a
2006.0/i586/postgresql-test-8.0.11-0.1.20060mdk.i586.rpm
2f456c000cba2ac5f98ab05bb1c8b400
2006.0/SRPMS/postgresql-8.0.11-0.1.20060mdk.src.rpm

Mandriva Linux 2006.0/X86_64:
04e172cf72fef2efc12d43d4906f2408
2006.0/x86_64/lib64ecpg5-8.0.11-0.1.20060mdk.x86_64.rpm
623fed2a8d785d71658705abd7d5d1f4
2006.0/x86_64/lib64ecpg5-devel-8.0.11-0.1.20060mdk.x86_64.rpm
ad035cd1c9c11346a683febb2cc56783
2006.0/x86_64/lib64pq4-8.0.11-0.1.20060mdk.x86_64.rpm
3762497183d1b702f6f4f9683e871c88
2006.0/x86_64/lib64pq4-devel-8.0.11-0.1.20060mdk.x86_64.rpm
ab263a98ce0b7179bfb834889c9facb0
2006.0/x86_64/postgresql-8.0.11-0.1.20060mdk.x86_64.rpm
af4b6e09c92f53d6541390c04e922f4d
2006.0/x86_64/postgresql-contrib-8.0.11-0.1.20060mdk.x86_64.rpm
9f2a34e6162f77dddcc185552e9cb619
2006.0/x86_64/postgresql-devel-8.0.11-0.1.20060mdk.x86_64.rpm
8ce393a46d3eff9c5ea7d632d139c8e2
2006.0/x86_64/postgresql-docs-8.0.11-0.1.20060mdk.x86_64.rpm
eee613b2b2df9565bc34dd70b4f4af3e
2006.0/x86_64/postgresql-jdbc-8.0.11-0.1.20060mdk.x86_64.rpm
6fbf3a35951d64936597a16e6aef59c5
2006.0/x86_64/postgresql-pl-8.0.11-0.1.20060mdk.x86_64.rpm
610fc142482dc119816bc37edbd16427
2006.0/x86_64/postgresql-plperl-8.0.11-0.1.20060mdk.x86_64.rpm
e63db598dd5c07c9abe67834c242cec4
2006.0/x86_64/postgresql-plpgsql-8.0.11-0.1.20060mdk.x86_64.rpm
f1398990db7f8fc80f31938c69f64153
2006.0/x86_64/postgresql-plpython-8.0.11-0.1.20060mdk.x86_64.rpm
612afa01e019d0da5b3fdd7e9c5579f0
2006.0/x86_64/postgresql-pltcl-8.0.11-0.1.20060mdk.x86_64.rpm
730a1ce6785ca112c63ee6367999e491
2006.0/x86_64/postgresql-server-8.0.11-0.1.20060mdk.x86_64.rpm
dd5931e07b71f7d39147061bef39d177
2006.0/x86_64/postgresql-test-8.0.11-0.1.20060mdk.x86_64.rpm
2f456c000cba2ac5f98ab05bb1c8b400
2006.0/SRPMS/postgresql-8.0.11-0.1.20060mdk.src.rpm

Mandriva Linux 2007.0:
d077be222aa54f1bf37f55a2b426a487
2007.0/i586/libecpg5-8.1.7-1.1mdv2007.0.i586.rpm
39c5c0d8ccfe2b16e04c71f63ca676dd
2007.0/i586/libecpg5-devel-8.1.7-1.1mdv2007.0.i586.rpm
b5509203ec7f9ef453341117305dcdb9
2007.0/i586/libpq4-8.1.7-1.1mdv2007.0.i586.rpm
1c9a4e7f08038413cc0f4ec7885a42a7
2007.0/i586/libpq4-devel-8.1.7-1.1mdv2007.0.i586.rpm
2dc5c3369f280892ce430f4cd64281ab
2007.0/i586/postgresql-8.1.7-1.1mdv2007.0.i586.rpm
7f32f50497435ec064c3aec25551a0af
2007.0/i586/postgresql-contrib-8.1.7-1.1mdv2007.0.i586.rpm
f5f3ac5638eea527abb3f945585cece7
2007.0/i586/postgresql-devel-8.1.7-1.1mdv2007.0.i586.rpm
3ab61d16063667f699326a6604303b50
2007.0/i586/postgresql-docs-8.1.7-1.1mdv2007.0.i586.rpm
dbc683ac58c893ffef301545ae5091ea
2007.0/i586/postgresql-pl-8.1.7-1.1mdv2007.0.i586.rpm
c34d1891abe81af46de910bd9d8c7a2d
2007.0/i586/postgresql-plperl-8.1.7-1.1mdv2007.0.i586.rpm
520adbe4ed1a43d0aa88f89bcd3a90e2
2007.0/i586/postgresql-plpgsql-8.1.7-1.1mdv2007.0.i586.rpm
6eca2470426328ebcdf83e6bd6acaf0a
2007.0/i586/postgresql-plpython-8.1.7-1.1mdv2007.0.i586.rpm
2cad17701ab6467d6bea6b95ed39b0d2
2007.0/i586/postgresql-pltcl-8.1.7-1.1mdv2007.0.i586.rpm
5c3166ca9b13c992aa3460899291a728
2007.0/i586/postgresql-server-8.1.7-1.1mdv2007.0.i586.rpm
52dc82a5c745e1f46a76ebf32ac3e2e5
2007.0/i586/postgresql-test-8.1.7-1.1mdv2007.0.i586.rpm
b8229227cba3278c0e40a99f6ef39883
2007.0/SRPMS/postgresql-8.1.7-1.1mdv2007.0.src.rpm

Mandriva Linux 2007.0/X86_64:
5315b2c35a453b577ee7847e019a846a
2007.0/x86_64/lib64ecpg5-8.1.7-1.1mdv2007.0.x86_64.rpm
2fe21dd9a0498b7001c9138cd9218159
2007.0/x86_64/lib64ecpg5-devel-8.1.7-1.1mdv2007.0.x86_64.rpm
dc4e1420d0d36ebcd56c196989fb6694
2007.0/x86_64/lib64pq4-8.1.7-1.1mdv2007.0.x86_64.rpm
e2efe03361910444fe6d684b4648876f
2007.0/x86_64/lib64pq4-devel-8.1.7-1.1mdv2007.0.x86_64.rpm
9b44f853f77f48a0088eb7943756b64e
2007.0/x86_64/postgresql-8.1.7-1.1mdv2007.0.x86_64.rpm
02a87ed9b62c4dd6206de8021755dea0
2007.0/x86_64/postgresql-contrib-8.1.7-1.1mdv2007.0.x86_64.rpm
82ade12fa019f039c989740b6484baee
2007.0/x86_64/postgresql-devel-8.1.7-1.1mdv2007.0.x86_64.rpm
d6a5eb5f86263626f4f7d94d145bb108
2007.0/x86_64/postgresql-docs-8.1.7-1.1mdv2007.0.x86_64.rpm
b7bad9fbe23450fb07c94ffa4135fed7
2007.0/x86_64/postgresql-pl-8.1.7-1.1mdv2007.0.x86_64.rpm
79a363334dba592ca80cac1017a45b1c
2007.0/x86_64/postgresql-plperl-8.1.7-1.1mdv2007.0.x86_64.rpm
38ea142b1a812fa734947a629e740151
2007.0/x86_64/postgresql-plpgsql-8.1.7-1.1mdv2007.0.x86_64.rpm
a623495f6bfc957139669a29ee13fb58
2007.0/x86_64/postgresql-plpython-8.1.7-1.1mdv2007.0.x86_64.rpm
e777974b7b49296dae095363b5448cc5
2007.0/x86_64/postgresql-pltcl-8.1.7-1.1mdv2007.0.x86_64.rpm
90e65a9ac76430df828265d6ea1d4c23
2007.0/x86_64/postgresql-server-8.1.7-1.1mdv2007.0.x86_64.rpm
eb7e03b7a74491f60bc4e4dd0ba9aff2
2007.0/x86_64/postgresql-test-8.1.7-1.1mdv2007.0.x86_64.rpm
b8229227cba3278c0e40a99f6ef39883
2007.0/SRPMS/postgresql-8.1.7-1.1mdv2007.0.src.rpm

Corporate 3.0:
25505c19ece576fefeba90b64caacfad
corporate/3.0/i586/libecpg3-7.4.1-2.8.C30mdk.i586.rpm
ef8a317c21785512de3144da1c9edff0
corporate/3.0/i586/libecpg3-devel-7.4.1-2.8.C30mdk.i586.rpm
45906f492059f08e3b5e0aa2595b5888
corporate/3.0/i586/libpgtcl2-7.4.1-2.8.C30mdk.i586.rpm
c44595a37d655f17c8f97e5a2e5cc5fa
corporate/3.0/i586/libpgtcl2-devel-7.4.1-2.8.C30mdk.i586.rpm
3b962bc41a1bbddfee5eef2fc554c7fb
corporate/3.0/i586/libpq3-7.4.1-2.8.C30mdk.i586.rpm
d8daf6f07762ff1a041761fe13591828
corporate/3.0/i586/libpq3-devel-7.4.1-2.8.C30mdk.i586.rpm
30c7d21119850ba8d84eb169c369723c
corporate/3.0/i586/postgresql-7.4.1-2.8.C30mdk.i586.rpm
a1a5653a3199fa56ce05d58a43636627
corporate/3.0/i586/postgresql-contrib-7.4.1-2.8.C30mdk.i586.rpm
aa51e081c03b40018ab21d0821c71fea
corporate/3.0/i586/postgresql-devel-7.4.1-2.8.C30mdk.i586.rpm
b13e32723f494af7bf0d28e6fab484a2
corporate/3.0/i586/postgresql-docs-7.4.1-2.8.C30mdk.i586.rpm
b64b66c52913c251fd920b7c932ede54
corporate/3.0/i586/postgresql-jdbc-7.4.1-2.8.C30mdk.i586.rpm
1fa995965d510d83b49ef5adb7d0fb30
corporate/3.0/i586/postgresql-pl-7.4.1-2.8.C30mdk.i586.rpm
b76e6848ef3e48239e9fadce93d4cf1e
corporate/3.0/i586/postgresql-server-7.4.1-2.8.C30mdk.i586.rpm
830a2abbba11c2a3888bb207ce1f2657
corporate/3.0/i586/postgresql-tcl-7.4.1-2.8.C30mdk.i586.rpm
6de4c509e8f30449de71ee847a72cc0b
corporate/3.0/i586/postgresql-test-7.4.1-2.8.C30mdk.i586.rpm
cb9f633aa33f20592c22d808d243e7f4
corporate/3.0/SRPMS/postgresql-7.4.1-2.8.C30mdk.src.rpm

Corporate 3.0/X86_64:
b96b64db68a43bd86803a7f625d98c2e
corporate/3.0/x86_64/lib64ecpg3-7.4.1-2.8.C30mdk.x86_64.rpm
37b035c411b06a3d4fbfd2479ded71cf
corporate/3.0/x86_64/lib64ecpg3-devel-7.4.1-2.8.C30mdk.x86_64.rpm
37f965d055dfc9b9243a667f876b3799
corporate/3.0/x86_64/lib64pgtcl2-7.4.1-2.8.C30mdk.x86_64.rpm
b127a439b633f1af2bb6a20475185f54
corporate/3.0/x86_64/lib64pgtcl2-devel-7.4.1-2.8.C30mdk.x86_64.rpm
3b2f7f2ada985794e9489f9049b00eb8
corporate/3.0/x86_64/lib64pq3-7.4.1-2.8.C30mdk.x86_64.rpm
0cf784d8f003c5956f19446032d97e29
corporate/3.0/x86_64/lib64pq3-devel-7.4.1-2.8.C30mdk.x86_64.rpm
bcd4e668928ab31ab0333dbd1212149f
corporate/3.0/x86_64/postgresql-7.4.1-2.8.C30mdk.x86_64.rpm
fee8199f9dff5f0d6a4a38e39f5b0777
corporate/3.0/x86_64/postgresql-contrib-7.4.1-2.8.C30mdk.x86_64.rpm
158768a27c1c8294e778599533d7a3c6
corporate/3.0/x86_64/postgresql-devel-7.4.1-2.8.C30mdk.x86_64.rpm
667ca4ec5ac29289c920af54a5f0cdeb
corporate/3.0/x86_64/postgresql-docs-7.4.1-2.8.C30mdk.x86_64.rpm
617d2d2cba98ad6079057f9262db16db
corporate/3.0/x86_64/postgresql-jdbc-7.4.1-2.8.C30mdk.x86_64.rpm
e849e37ba7648ba47b00bfeef98e2bdf
corporate/3.0/x86_64/postgresql-pl-7.4.1-2.8.C30mdk.x86_64.rpm
5d834d6bb8a0736fafdde2ba4ced93a0
corporate/3.0/x86_64/postgresql-server-7.4.1-2.8.C30mdk.x86_64.rpm
9744b6d4b67486a1319605f8738de97d
corporate/3.0/x86_64/postgresql-tcl-7.4.1-2.8.C30mdk.x86_64.rpm
836a7ab39147cbbde85473848756c2ea
corporate/3.0/x86_64/postgresql-test-7.4.1-2.8.C30mdk.x86_64.rpm
cb9f633aa33f20592c22d808d243e7f4
corporate/3.0/SRPMS/postgresql-7.4.1-2.8.C30mdk.src.rpm

Corporate 4.0:
457ceff22a6c29fe8f7bb0b4a4cc3df5
corporate/4.0/i586/libecpg5-8.1.7-0.1.20060mlcs4.i586.rpm
2dee4d9b77250de0f5d79c9037ce4848
corporate/4.0/i586/libecpg5-devel-8.1.7-0.1.20060mlcs4.i586.rpm
4f1911b331aff03b1eedcc2967057f9f
corporate/4.0/i586/libpq4-8.1.7-0.1.20060mlcs4.i586.rpm
2d5d829588b7a2ff81f6f364fb194618
corporate/4.0/i586/libpq4-devel-8.1.7-0.1.20060mlcs4.i586.rpm
3077227d7bee4836cabfc94113a39128
corporate/4.0/i586/postgresql-8.1.7-0.1.20060mlcs4.i586.rpm
a4612b1ef4e8142e9f41c4760b8df2ec
corporate/4.0/i586/postgresql-contrib-8.1.7-0.1.20060mlcs4.i586.rpm
6389bd557862c884c037300230f1d31c
corporate/4.0/i586/postgresql-devel-8.1.7-0.1.20060mlcs4.i586.rpm
494f2995b8596943902d78796d25c2f4
corporate/4.0/i586/postgresql-docs-8.1.7-0.1.20060mlcs4.i586.rpm
9d85c833eb5881d97934f8a40cee08a5
corporate/4.0/i586/postgresql-pl-8.1.7-0.1.20060mlcs4.i586.rpm
3faa914bb1127a5eff6fc61630e790ba
corporate/4.0/i586/postgresql-plperl-8.1.7-0.1.20060mlcs4.i586.rpm
accb18c13908b0dc72ade4f40ebf2d45
corporate/4.0/i586/postgresql-plpgsql-8.1.7-0.1.20060mlcs4.i586.rpm
e11f6aeb959c6567433706a07cc353f0
corporate/4.0/i586/postgresql-plpython-8.1.7-0.1.20060mlcs4.i586.rpm
3e899419b6b6fb47a9e1820db71c15b0
corporate/4.0/i586/postgresql-pltcl-8.1.7-0.1.20060mlcs4.i586.rpm
875f0e29feb28ba52b70d73979c3d429
corporate/4.0/i586/postgresql-server-8.1.7-0.1.20060mlcs4.i586.rpm
0fe3ea03a120de6624f186bf5cac455c
corporate/4.0/i586/postgresql-test-8.1.7-0.1.20060mlcs4.i586.rpm
fbb03a99b9795af2ebb6dde46545326d
corporate/4.0/SRPMS/postgresql-8.1.7-0.1.20060mlcs4.src.rpm

Corporate 4.0/X86_64:
626c0bfcc24162f9f29081ba1c605d13
corporate/4.0/x86_64/lib64ecpg5-8.1.7-0.1.20060mlcs4.x86_64.rpm
32e767d1264b2d6fbfaf659f0f98d02e
corporate/4.0/x86_64/lib64ecpg5-devel-8.1.7-0.1.20060mlcs4.x86_64.rpm
3ae4b9b8ad30f358d486cbaa3c6d489d
corporate/4.0/x86_64/lib64pq4-8.1.7-0.1.20060mlcs4.x86_64.rpm
87b7ebb3f9ce5c9bd62f5738c3b0b1b6
corporate/4.0/x86_64/lib64pq4-devel-8.1.7-0.1.20060mlcs4.x86_64.rpm
f2337cb010b7e1d2f75867fb6e909a9f
corporate/4.0/x86_64/postgresql-8.1.7-0.1.20060mlcs4.x86_64.rpm
428d3b26f7700141a7772e42395c8e36
corporate/4.0/x86_64/postgresql-contrib-8.1.7-0.1.20060mlcs4.x86_64.rpm
a064cf7e03d4b1d42b3b3738d5cc08bb
corporate/4.0/x86_64/postgresql-devel-8.1.7-0.1.20060mlcs4.x86_64.rpm
d33e4335306ac9bc001f52365c22906c
corporate/4.0/x86_64/postgresql-docs-8.1.7-0.1.20060mlcs4.x86_64.rpm
644e77f4587a6123609888e127b00c40
corporate/4.0/x86_64/postgresql-pl-8.1.7-0.1.20060mlcs4.x86_64.rpm
bffedbcd41eebb83c2752184a5eebc21
corporate/4.0/x86_64/postgresql-plperl-8.1.7-0.1.20060mlcs4.x86_64.rpm
8ab83c15fa0513cbe7c13b8b101a37c6
corporate/4.0/x86_64/postgresql-plpgsql-8.1.7-0.1.20060mlcs4.x86_64.rpm
bf7f711a4b5d444bd625829e61bd385e
corporate/4.0/x86_64/postgresql-plpython-8.1.7-0.1.20060mlcs4.x86_64.rpm
d3951b5e225842f185ed14e2c381ea9f
corporate/4.0/x86_64/postgresql-pltcl-8.1.7-0.1.20060mlcs4.x86_64.rpm
3ba6e069c883bb138a4eb0d1ece4c31f
corporate/4.0/x86_64/postgresql-server-8.1.7-0.1.20060mlcs4.x86_64.rpm
de212c2885533ddd6d011589e5701a2b
corporate/4.0/x86_64/postgresql-test-8.1.7-0.1.20060mlcs4.x86_64.rpm
fbb03a99b9795af2ebb6dde46545326d
corporate/4.0/SRPMS/postgresql-8.1.7-0.1.20060mlcs4.src.rpm
_______________________________________________________________________

To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.

All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:

gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98

You can view other update advisories for Mandriva Linux at:

http://www.mandriva.com/security/advisories

If you want to report vulnerabilities, please contact

security_(at)_mandriva.com
_______________________________________________________________________

Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.6 (GNU/Linux)

iD8DBQFFyQtymqjQ0CJFipgRArj0AJ93UmcMvGbxGYJC74oHjDstlglNcgCfUZEZ
eQGB1z/8sIjXz75tMhDhLSc=
=ZLG5
-----END PGP SIGNATURE-----

------------=_1170821862-16192-9192
Content-Type: text/plain; name="message-footer.txt"
Content-Disposition: inline; filename="message-footer.txt"
Content-Transfer-Encoding: 8bit

To unsubscribe, send a email to sympa@mandrivalinux.org
with this subject : unsubscribe security-announce
_______________________________________________________
Want to buy your Pack or Services from Mandriva?
Go to http://www.mandrivastore.com
Join the Club : http://www.mandrivaclub.com
_______________________________________________________

------------=_1170821862-16192-9192--