CVEvulnerability
CVE-2007-3279
10.0 HIGH
Official page ↗
- Status
- Modified
- Published
- 2007-06-19
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
Description
PostgreSQL 8.1 and probably later versions, when the PL/pgSQL (plpgsql) language has been created, grants certain plpgsql privileges to the PUBLIC domain, which allows remote attackers to create and execute functions, as demonstrated by functions that perform local brute-force password guessing attacks, which may evade intrusion detection.
Affected configurations
• postgresql postgresql 8.1
References
- http://osvdb.org/40900 osvdb.org
- http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt www.leidecker.info
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:188 www.mandriva.com
- http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf www.portcullis.co.uk
- http://www.securityfocus.com/archive/1/471541/100/0/threaded www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35144 exchange.xforce.ibmcloud.com
- http://osvdb.org/40900 osvdb.org
- http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt www.leidecker.info
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:188 www.mandriva.com
- http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf www.portcullis.co.uk
- http://www.securityfocus.com/archive/1/471541/100/0/threaded www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35144 exchange.xforce.ibmcloud.com