Advisories MDKSA-2007:188: Updated postgresql packages prevent access abuse using dblink

[paul]

PostgreSQL 8.1 and probably later and earlier versions, when local

trust authentication is enabled and the Database Link library (dblink)

is installed, allows remote attackers to access arbitrary accounts

and execute arbitrary SQL queries via a dblink host parameter that

proxies the connection from 127.0.0.1. (CVE-2007-3278)

 

PostgreSQL 8.1 and probably later and earlier versions, when the

PL/pgSQL (plpgsql) language has been created, grants certain plpgsql

privileges to the PUBLIC domain, which allows remote attackers

to create and execute functions, as demonstrated by functions that

perform local brute-force password guessing attacks, which may evade

intrusion detection. (CVE-2007-3279)

 

The Database Link library (dblink) in PostgreSQL 8.1 implements

functions via CREATE statements that map to arbitrary libraries based

on the C programming language, which allows remote authenticated

superusers to map and execute a function from any library, as

demonstrated by using the system function in libc.so.6 to gain shell

access. (CVE-2007-3280)

 

Updated packages fix these issues, by requiring non-superusers who

use /contrib/dblink to use only password authentication.