CVEvulnerability
CVE-2009-3230
6.5 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-09-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.
Affected configurations
• postgresql postgresql 7.4
• postgresql postgresql 7.4.1
• postgresql postgresql 7.4.2
• postgresql postgresql 7.4.3
• postgresql postgresql 7.4.4
• postgresql postgresql 7.4.5
• postgresql postgresql 7.4.6
• postgresql postgresql 7.4.7
• postgresql postgresql 7.4.8
• postgresql postgresql 7.4.9
• postgresql postgresql 7.4.10
• postgresql postgresql 7.4.11
• postgresql postgresql 7.4.12
• postgresql postgresql 7.4.13
• postgresql postgresql 7.4.14
• postgresql postgresql 7.4.15
• postgresql postgresql 7.4.16
• postgresql postgresql 7.4.17
• postgresql postgresql 7.4.18
• postgresql postgresql 7.4.19
• postgresql postgresql 7.4.20
• postgresql postgresql 7.4.21
• postgresql postgresql 7.4.22
• postgresql postgresql 7.4.23
• postgresql postgresql 7.4.24
• postgresql postgresql 7.4.25
• postgresql postgresql 8.0
• postgresql postgresql 8.0.1
• postgresql postgresql 8.0.2
• postgresql postgresql 8.0.3
• postgresql postgresql 8.0.4
• postgresql postgresql 8.0.5
• postgresql postgresql 8.0.6
• postgresql postgresql 8.0.7
• postgresql postgresql 8.0.8
• postgresql postgresql 8.0.9
• postgresql postgresql 8.0.10
• postgresql postgresql 8.0.11
• postgresql postgresql 8.0.12
• postgresql postgresql 8.0.13
• postgresql postgresql 8.0.14
• postgresql postgresql 8.0.15
• postgresql postgresql 8.0.16
• postgresql postgresql 8.0.17
• postgresql postgresql 8.0.18
• postgresql postgresql 8.0.19
• postgresql postgresql 8.0.20
• postgresql postgresql 8.0.21
• postgresql postgresql 8.1
• postgresql postgresql 8.1.1
• postgresql postgresql 8.1.2
• postgresql postgresql 8.1.3
• postgresql postgresql 8.1.4
• postgresql postgresql 8.1.5
• postgresql postgresql 8.1.6
• postgresql postgresql 8.1.7
• postgresql postgresql 8.1.8
• postgresql postgresql 8.1.9
• postgresql postgresql 8.1.10
• postgresql postgresql 8.1.11
… and 27 more
Related
Weakness · not in database (1)
References
- http://archives.postgresql.org/pgsql-www/2009-09/msg00024.php archives.postgresql.org
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html lists.opensuse.org
- http://marc.info/?l=bugtraq&m=134124585221119&w=2 marc.info
- http://secunia.com/advisories/36660 Vendor Advisory
- http://secunia.com/advisories/36695 Vendor Advisory
- http://secunia.com/advisories/36727 Vendor Advisory
- http://secunia.com/advisories/36800 secunia.com
- http://secunia.com/advisories/36837 secunia.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1 sunsolve.sun.com
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012 wiki.rpath.com
- http://www.postgresql.org/docs/8.3/static/release-8-3-8.html Vendor Advisory
- http://www.postgresql.org/support/security.html Vendor Advisory
- http://www.securityfocus.com/archive/1/509917/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/36314 www.securityfocus.com
- http://www.ubuntu.com/usn/usn-834-1 www.ubuntu.com
- http://www.us.debian.org/security/2009/dsa-1900 www.us.debian.org
- http://www.vupen.com/english/advisories/2009/2602 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=522085 bugzilla.redhat.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10166 oval.cisecurity.org
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html www.redhat.com
- http://archives.postgresql.org/pgsql-www/2009-09/msg00024.php archives.postgresql.org
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html lists.opensuse.org
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html lists.opensuse.org
- http://marc.info/?l=bugtraq&m=134124585221119&w=2 marc.info
- http://secunia.com/advisories/36660 Vendor Advisory
- http://secunia.com/advisories/36695 Vendor Advisory
- http://secunia.com/advisories/36727 Vendor Advisory
- http://secunia.com/advisories/36800 secunia.com
- http://secunia.com/advisories/36837 secunia.com
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1 sunsolve.sun.com
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012 wiki.rpath.com
- http://www.postgresql.org/docs/8.3/static/release-8-3-8.html Vendor Advisory
- http://www.postgresql.org/support/security.html Vendor Advisory
- http://www.securityfocus.com/archive/1/509917/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/36314 www.securityfocus.com
- http://www.ubuntu.com/usn/usn-834-1 www.ubuntu.com
- http://www.us.debian.org/security/2009/dsa-1900 www.us.debian.org
- http://www.vupen.com/english/advisories/2009/2602 Vendor Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=522085 bugzilla.redhat.com
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10166 oval.cisecurity.org
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html www.redhat.com
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html www.redhat.com