CVEvulnerability
CVE-2009-3231
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-09-17
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.
Affected configurations
• postgresql postgresql (>= 8.2 < 8.2.14)
• postgresql postgresql (>= 8.3 < 8.3.8)
• opensuse opensuse (>= 10.3 <= 11.1)
• suse linux enterprise 10.0
• suse linux enterprise 11.0
• suse linux enterprise server 9
• fedoraproject fedora 10
• fedoraproject fedora 11
• canonical ubuntu linux 6.06
• canonical ubuntu linux 8.04
• canonical ubuntu linux 8.10
• canonical ubuntu linux 9.04
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
Referenced by CWE · observed example (1)
- CWE-287 Improper Authentication weakness
References
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html Mailing List
- http://marc.info/?l=bugtraq&m=134124585221119&w=2 Mailing List
- http://secunia.com/advisories/36660 Broken Link, Vendor Advisory
- http://secunia.com/advisories/36727 Broken Link, Vendor Advisory
- http://secunia.com/advisories/36800 Broken Link
- http://secunia.com/advisories/36837 Broken Link
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012 Broken Link
- http://www.postgresql.org/docs/8.3/static/release-8-3-8.html Release Notes
- http://www.postgresql.org/support/security.html Broken Link, Vendor Advisory
- http://www.securityfocus.com/archive/1/509917/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/36314 Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/usn-834-1 Third Party Advisory
- http://www.us.debian.org/security/2009/dsa-1900 Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=522084 Issue Tracking, Patch
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html Mailing List
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html Mailing List
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html Mailing List
- http://marc.info/?l=bugtraq&m=134124585221119&w=2 Mailing List
- http://secunia.com/advisories/36660 Broken Link, Vendor Advisory
- http://secunia.com/advisories/36727 Broken Link, Vendor Advisory
- http://secunia.com/advisories/36800 Broken Link
- http://secunia.com/advisories/36837 Broken Link
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012 Broken Link
- http://www.postgresql.org/docs/8.3/static/release-8-3-8.html Release Notes
- http://www.postgresql.org/support/security.html Broken Link, Vendor Advisory
- http://www.securityfocus.com/archive/1/509917/100/0/threaded Broken Link, Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/36314 Broken Link, Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/usn-834-1 Third Party Advisory
- http://www.us.debian.org/security/2009/dsa-1900 Broken Link
- https://bugzilla.redhat.com/show_bug.cgi?id=522084 Issue Tracking, Patch
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html Mailing List
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html Mailing List