[ MDKSA-2007:094 ] - Updated postgresql packages fix vulnerability
To: [email protected]
Subject: [ MDKSA-2007:094 ] - Updated postgresql packages fix vulnerability
Date: Wed, 25 Apr 2007 18:59:21 -0600
From: [email protected]
Reply-To: <xsecurity@mandriva.com.>
Message-Id: <E1HgsKP-0007SE-Ig@artemis.annvix.ca.>
Sender: QA Team <qateam@artemis.annvix.ca.>
X-Virus-Scanned: antivirus-gw at tyumen.ru
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
_______________________________________________________________________
Mandriva Linux Security Advisory MDKSA-2007:094
http://www.mandriva.com/security/
_______________________________________________________________________
Package : postgresql
Date : April 25, 2007
Affected: 2007.0, 2007.1, Corporate 3.0, Corporate 4.0
_______________________________________________________________________
Problem Description:
A weakness in previous versions of PostgreSQL was found in the security
definer functions in which an authenticated but otherwise unprivileged
SQL user could use temporary objects to execute arbitrary code with
the privileges of the security-definer function.
IMPORTANT NOTICE FOR CORPORATE SERVER/DESKTOP 3.0 USERS:
In addition, packages for Corporate Server/Desktop 3.0 have been
updated to the latest PostgreSQL 7.4.17 which requires some attention
when upgrading. To take advantage of the new version, and to ensure
data coherency, we strongly recommend dumping the old databases,
re-initializing the database, and then reloading the dumped data.
This can be accomplished as root using:
# service postgresql start
# su - postgres
$ pg_dumpall >/tmp/database.dump
$ exit
# service postgresql stop
# mv /var/lib/pgsql /var/lib/pgsql.bk
# urpmi.update -a && urpmi --auto-select
# service postgresql start
# service postgresql restart
# su - postgres
$ /usr/bin/psql -d template1 -f /tmp/database.dump
$ exit
Only Corporate Server/Desktop 3.0 requires the dump/reload steps; the
other Mandriva Linux platforms do not require this step. Notice that
the double-restart of the postgresql service is in fact required.
Updated packages have been patched to correct this issue.
_______________________________________________________________________
References:
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2138
_______________________________________________________________________
Updated Packages:
Mandriva Linux 2007.0:
517c0f9071eef1db7312a241b73e070a 2007.0/i586/libecpg5-8.1.9-0.1mdv2007.0.i586.rpm
cb5a3512bac8ba30fc6bd25126e7d973 2007.0/i586/libecpg5-devel-8.1.9-0.1mdv2007.0.i586.rpm
a2bfd8394996ba5d3f126845bd1d39a6 2007.0/i586/libpq4-8.1.9-0.1mdv2007.0.i586.rpm
153cb0fda3a93eaf94047159db3ad02f 2007.0/i586/libpq4-devel-8.1.9-0.1mdv2007.0.i586.rpm
cb23fbf89a08fa99c7af9295727c0f2a 2007.0/i586/postgresql-8.1.9-0.1mdv2007.0.i586.rpm
1c03e49038d17a7940b0f82164bd51c0 2007.0/i586/postgresql-contrib-8.1.9-0.1mdv2007.0.i586.rpm
fef94b3d46b3147a09cb4f411bce3afd 2007.0/i586/postgresql-devel-8.1.9-0.1mdv2007.0.i586.rpm
6fa0ab68b6c4543bbafda41ffc1155a8 2007.0/i586/postgresql-docs-8.1.9-0.1mdv2007.0.i586.rpm
f20c091179c00891eda767b44b0b2967 2007.0/i586/postgresql-pl-8.1.9-0.1mdv2007.0.i586.rpm
1f5030079690ba65b394aa47abdb1859 2007.0/i586/postgresql-plperl-8.1.9-0.1mdv2007.0.i586.rpm
72a62a6232a3717f14400294dcc47a80 2007.0/i586/postgresql-plpgsql-8.1.9-0.1mdv2007.0.i586.rpm
51c8d98ece4ef4458cea22c62507f6f7 2007.0/i586/postgresql-plpython-8.1.9-0.1mdv2007.0.i586.rpm
d60056d27325176ebc461e904f4684a6 2007.0/i586/postgresql-pltcl-8.1.9-0.1mdv2007.0.i586.rpm
eb8977e8b9faa6cf36396b3f33612bcb 2007.0/i586/postgresql-server-8.1.9-0.1mdv2007.0.i586.rpm
28efd3e89e067cd5b68d3f61cd4b31e8 2007.0/i586/postgresql-test-8.1.9-0.1mdv2007.0.i586.rpm
604ab4c1eff9169d56d43b0568753d0c 2007.0/SRPMS/postgresql-8.1.9-0.1mdv2007.0.src.rpm
Mandriva Linux 2007.0/X86_64:
956402065653e2a9785ae104e0dc06ab 2007.0/x86_64/lib64ecpg5-8.1.9-0.1mdv2007.0.x86_64.rpm
91bdb9081eaed193022182145efc62a5 2007.0/x86_64/lib64ecpg5-devel-8.1.9-0.1mdv2007.0.x86_64.rpm
600f760d422ff727cbc69057e15aa9a3 2007.0/x86_64/lib64pq4-8.1.9-0.1mdv2007.0.x86_64.rpm
8cd8c17a22440ee52aabcca214d24c93 2007.0/x86_64/lib64pq4-devel-8.1.9-0.1mdv2007.0.x86_64.rpm
46a5faf0211731467ed7dbf1c890f946 2007.0/x86_64/postgresql-8.1.9-0.1mdv2007.0.x86_64.rpm
38369d3fb261f3bc18c4ace02ef9e6a2 2007.0/x86_64/postgresql-contrib-8.1.9-0.1mdv2007.0.x86_64.rpm
60719dbcdb0554cdb0086d4fb9c62339 2007.0/x86_64/postgresql-devel-8.1.9-0.1mdv2007.0.x86_64.rpm
87b08466fd00a86aae809df4fb7924b2 2007.0/x86_64/postgresql-docs-8.1.9-0.1mdv2007.0.x86_64.rpm
269cb2eb609009b984fbea3617f336d5 2007.0/x86_64/postgresql-pl-8.1.9-0.1mdv2007.0.x86_64.rpm
b40470ee91762d039592acf38575a00e 2007.0/x86_64/postgresql-plperl-8.1.9-0.1mdv2007.0.x86_64.rpm
4457df5483f614c76705635ef5c0ac4b 2007.0/x86_64/postgresql-plpgsql-8.1.9-0.1mdv2007.0.x86_64.rpm
dcfec6ba4550a20ac2e0802aaa1c8494 2007.0/x86_64/postgresql-plpython-8.1.9-0.1mdv2007.0.x86_64.rpm
a94b7517375b9133202504f22b8bf33e 2007.0/x86_64/postgresql-pltcl-8.1.9-0.1mdv2007.0.x86_64.rpm
3d1ae4efa79c8d6853eb65e565aa390e 2007.0/x86_64/postgresql-server-8.1.9-0.1mdv2007.0.x86_64.rpm
b39077e2c2c8869de50be2ca624df823 2007.0/x86_64/postgresql-test-8.1.9-0.1mdv2007.0.x86_64.rpm
604ab4c1eff9169d56d43b0568753d0c 2007.0/SRPMS/postgresql-8.1.9-0.1mdv2007.0.src.rpm
Mandriva Linux 2007.1:
3df8944a00c7c726387c7324f9815e90 2007.1/i586/libecpg5-8.2.4-0.1mdv2007.1.i586.rpm
9123e4fcbc39c0abd1b5e0135a156ab0 2007.1/i586/libecpg5-devel-8.2.4-0.1mdv2007.1.i586.rpm
60350e3f9a207d9439c6d8e232ed6bbd 2007.1/i586/libpq5-8.2.4-0.1mdv2007.1.i586.rpm
478927128426902f1367dfbea504fc88 2007.1/i586/libpq5-devel-8.2.4-0.1mdv2007.1.i586.rpm
a17e76d43c869bba5c4dc9e1629ff91d 2007.1/i586/postgresql-8.2.4-0.1mdv2007.1.i586.rpm
179eb9d1dfcb125ccd1e569b3a92b30d 2007.1/i586/postgresql-contrib-8.2.4-0.1mdv2007.1.i586.rpm
0a188af2e9d35040f0c8e9db571206c1 2007.1/i586/postgresql-devel-8.2.4-0.1mdv2007.1.i586.rpm
39f48d42719454c67b9cfa85fa6e8023 2007.1/i586/postgresql-docs-8.2.4-0.1mdv2007.1.i586.rpm
f25da3d2fd0db47de0bba8d6c1116684 2007.1/i586/postgresql-pl-8.2.4-0.1mdv2007.1.i586.rpm
3873417cec41b3bb4a0ec8719940e3d8 2007.1/i586/postgresql-plperl-8.2.4-0.1mdv2007.1.i586.rpm
35c93ec505a67aa46c21a206ac1eb841 2007.1/i586/postgresql-plpgsql-8.2.4-0.1mdv2007.1.i586.rpm
0d0319c172da8873c9ad64ad0fcfc6a8 2007.1/i586/postgresql-plpython-8.2.4-0.1mdv2007.1.i586.rpm
7ac251f460862145dd82c997b67ae669 2007.1/i586/postgresql-pltcl-8.2.4-0.1mdv2007.1.i586.rpm
135c8bd0237ee75ff9e29d425ccbf172 2007.1/i586/postgresql-server-8.2.4-0.1mdv2007.1.i586.rpm
0ef7f082b9ebc07608e486af4b9dd56b 2007.1/i586/postgresql-test-8.2.4-0.1mdv2007.1.i586.rpm
638359cb35d5a9622070499a9514eced 2007.1/SRPMS/postgresql-8.2.4-0.1mdv2007.1.src.rpm
Mandriva Linux 2007.1/X86_64:
5b5d13fbf6a32b4b3e911e1b5134d465 2007.1/x86_64/lib64ecpg5-8.2.4-0.1mdv2007.1.x86_64.rpm
93d08d1eba51cff345ff9d6acb5fa796 2007.1/x86_64/lib64ecpg5-devel-8.2.4-0.1mdv2007.1.x86_64.rpm
4380464897593e9374f7bf774c905ba6 2007.1/x86_64/lib64pq5-8.2.4-0.1mdv2007.1.x86_64.rpm
0b3a2954c1fee9048f6ace8a626d62e8 2007.1/x86_64/lib64pq5-devel-8.2.4-0.1mdv2007.1.x86_64.rpm
f6ae0606cd7134f068aaaf8c2fff0292 2007.1/x86_64/postgresql-8.2.4-0.1mdv2007.1.x86_64.rpm
ee14e3acca88b4cd0d734e5397769831 2007.1/x86_64/postgresql-contrib-8.2.4-0.1mdv2007.1.x86_64.rpm
ddeacc659f35ec9afad0dd8c21400b9f 2007.1/x86_64/postgresql-devel-8.2.4-0.1mdv2007.1.x86_64.rpm
cbc808e7738a35e3ebd1b6991a59cb79 2007.1/x86_64/postgresql-docs-8.2.4-0.1mdv2007.1.x86_64.rpm
c79feee4c88e60db37685365a27921a3 2007.1/x86_64/postgresql-pl-8.2.4-0.1mdv2007.1.x86_64.rpm
61a4559ed41a5eef3bf243b5ebbd88cb 2007.1/x86_64/postgresql-plperl-8.2.4-0.1mdv2007.1.x86_64.rpm
8d25dff12db7440d87db77b80f07c9a1 2007.1/x86_64/postgresql-plpgsql-8.2.4-0.1mdv2007.1.x86_64.rpm
b7c817ff49998108979134c824280361 2007.1/x86_64/postgresql-plpython-8.2.4-0.1mdv2007.1.x86_64.rpm
e032ba1974c54e5d501e4d795b6ea019 2007.1/x86_64/postgresql-pltcl-8.2.4-0.1mdv2007.1.x86_64.rpm
12eb8f8af0436827d60f7a2e20e54ffc 2007.1/x86_64/postgresql-server-8.2.4-0.1mdv2007.1.x86_64.rpm
38da203b39fee5d033aa8d4d271aad31 2007.1/x86_64/postgresql-test-8.2.4-0.1mdv2007.1.x86_64.rpm
638359cb35d5a9622070499a9514eced 2007.1/SRPMS/postgresql-8.2.4-0.1mdv2007.1.src.rpm
Corporate 3.0:
646d1967c7817bd3e947625e917e419a corporate/3.0/i586/libecpg3-7.4.17-0.1.C30mdk.i586.rpm
e6c0665d1c1f6d01fb593cea793fd21c corporate/3.0/i586/libecpg3-devel-7.4.17-0.1.C30mdk.i586.rpm
367a1a5e41296de44fc00c8d503b6249 corporate/3.0/i586/libpgtcl2-7.4.17-0.1.C30mdk.i586.rpm
5bd97bab3949788023eb19c7ba2e7741 corporate/3.0/i586/libpgtcl2-devel-7.4.17-0.1.C30mdk.i586.rpm
b6cdfd8367295ac9fa7b2f2cf6f905f9 corporate/3.0/i586/libpq3-7.4.17-0.1.C30mdk.i586.rpm
19555e20d9aa178b51143528e77e6475 corporate/3.0/i586/libpq3-devel-7.4.17-0.1.C30mdk.i586.rpm
f5c5a879c52f82c4b16bc938b62ee91c corporate/3.0/i586/postgresql-7.4.17-0.1.C30mdk.i586.rpm
03ac74dbeef39af84eec102c56976107 corporate/3.0/i586/postgresql-contrib-7.4.17-0.1.C30mdk.i586.rpm
72556b095557727b9b0736853fae9119 corporate/3.0/i586/postgresql-devel-7.4.17-0.1.C30mdk.i586.rpm
8e0b157624f8ebb0f3670ee72569afd8 corporate/3.0/i586/postgresql-docs-7.4.17-0.1.C30mdk.i586.rpm
4e3edb25340151d205a424f01dcf3075 corporate/3.0/i586/postgresql-jdbc-7.4.17-0.1.C30mdk.i586.rpm
c2eb436905577516055dd7acad6a2557 corporate/3.0/i586/postgresql-pl-7.4.17-0.1.C30mdk.i586.rpm
d1896f68eb93440a07b873b07b86d61f corporate/3.0/i586/postgresql-server-7.4.17-0.1.C30mdk.i586.rpm
8e8b4827ad3e766e59e186af3413e020 corporate/3.0/i586/postgresql-tcl-7.4.17-0.1.C30mdk.i586.rpm
109de6e1ebda4fd83a74110ca41414a9 corporate/3.0/i586/postgresql-test-7.4.17-0.1.C30mdk.i586.rpm
bbdbb4097ed1b4dfd5080c9f0816fbec corporate/3.0/SRPMS/postgresql-7.4.17-0.1.C30mdk.src.rpm
Corporate 3.0/X86_64:
2b143feeb5d1460f147cab172706f156 corporate/3.0/x86_64/lib64ecpg3-7.4.17-0.1.C30mdk.x86_64.rpm
32a80a738198e678841c80e4738de4c4 corporate/3.0/x86_64/lib64ecpg3-devel-7.4.17-0.1.C30mdk.x86_64.rpm
21385b87ec19b57fcdba5377e24201d9 corporate/3.0/x86_64/lib64pgtcl2-7.4.17-0.1.C30mdk.x86_64.rpm
5f0510dcf64dac9e17a5b441c925b6fc corporate/3.0/x86_64/lib64pgtcl2-devel-7.4.17-0.1.C30mdk.x86_64.rpm
e3232ef519e99c09d9dedd1f10de45de corporate/3.0/x86_64/lib64pq3-7.4.17-0.1.C30mdk.x86_64.rpm
9dc4969b13607f1a33ecff25e43b1935 corporate/3.0/x86_64/lib64pq3-devel-7.4.17-0.1.C30mdk.x86_64.rpm
567b7aea6434a684998f34d9186fc6fd corporate/3.0/x86_64/postgresql-7.4.17-0.1.C30mdk.x86_64.rpm
1e45d7fceecfb8bf86d2744068872f19 corporate/3.0/x86_64/postgresql-contrib-7.4.17-0.1.C30mdk.x86_64.rpm
9d490e14abd370b034bafe7a486549de corporate/3.0/x86_64/postgresql-devel-7.4.17-0.1.C30mdk.x86_64.rpm
e5a672ec89a58203b911de64c045f8f3 corporate/3.0/x86_64/postgresql-docs-7.4.17-0.1.C30mdk.x86_64.rpm
21ead848412a1061b39ac086685d77b6 corporate/3.0/x86_64/postgresql-jdbc-7.4.17-0.1.C30mdk.x86_64.rpm
530ad70509220bca3411120d0020173f corporate/3.0/x86_64/postgresql-pl-7.4.17-0.1.C30mdk.x86_64.rpm
de958377b2104311b8916ef16847346f corporate/3.0/x86_64/postgresql-server-7.4.17-0.1.C30mdk.x86_64.rpm
111f10b26fe26f15727071db0d868de0 corporate/3.0/x86_64/postgresql-tcl-7.4.17-0.1.C30mdk.x86_64.rpm
08780f0b4793e9c40c4c666b8d13aa21 corporate/3.0/x86_64/postgresql-test-7.4.17-0.1.C30mdk.x86_64.rpm
bbdbb4097ed1b4dfd5080c9f0816fbec corporate/3.0/SRPMS/postgresql-7.4.17-0.1.C30mdk.src.rpm
Corporate 4.0:
9d185ded15856e8aa9d29d13c393005a corporate/4.0/i586/libecpg5-8.1.9-0.1.20060mlcs4.i586.rpm
bf335907250df8f84abd05e7a4019efa corporate/4.0/i586/libecpg5-devel-8.1.9-0.1.20060mlcs4.i586.rpm
d6fc5b70aadaaa5014bb80a7a581c7d5 corporate/4.0/i586/libpq4-8.1.9-0.1.20060mlcs4.i586.rpm
ed243f7b358a4073f88b0656c4ad2a10 corporate/4.0/i586/libpq4-devel-8.1.9-0.1.20060mlcs4.i586.rpm
418f422c981814dbfdcfbb2333ff830a corporate/4.0/i586/postgresql-8.1.9-0.1.20060mlcs4.i586.rpm
74995dd790cccd97fa3a4d901d85a747 corporate/4.0/i586/postgresql-contrib-8.1.9-0.1.20060mlcs4.i586.rpm
0f18a025f73ef5a134cae5ae079a82c6 corporate/4.0/i586/postgresql-devel-8.1.9-0.1.20060mlcs4.i586.rpm
fb19e6d64b4c2442e09afb24029b455a corporate/4.0/i586/postgresql-docs-8.1.9-0.1.20060mlcs4.i586.rpm
3c901904f77b3acbc07162484a93fe95 corporate/4.0/i586/postgresql-pl-8.1.9-0.1.20060mlcs4.i586.rpm
a8076e3bb600f7269c6c3c8dd75570ad corporate/4.0/i586/postgresql-plperl-8.1.9-0.1.20060mlcs4.i586.rpm
e2bb6062954a04fb8301071c276f4ce9 corporate/4.0/i586/postgresql-plpgsql-8.1.9-0.1.20060mlcs4.i586.rpm
bee2865980ab79245f1ffcec5859afee corporate/4.0/i586/postgresql-plpython-8.1.9-0.1.20060mlcs4.i586.rpm
8611728b252c1850a425d1df7e959e28 corporate/4.0/i586/postgresql-pltcl-8.1.9-0.1.20060mlcs4.i586.rpm
da191a0cc07b06c88907622e418f8edf corporate/4.0/i586/postgresql-server-8.1.9-0.1.20060mlcs4.i586.rpm
2f2f4910e1b1eddbc20143370d37d492 corporate/4.0/i586/postgresql-test-8.1.9-0.1.20060mlcs4.i586.rpm
ca8d689948255f7272231c30ac7b77e8 corporate/4.0/SRPMS/postgresql-8.1.9-0.1.20060mlcs4.src.rpm
Corporate 4.0/X86_64:
3a9d2c4576c880d88e745dbe483ab745 corporate/4.0/x86_64/lib64ecpg5-8.1.9-0.1.20060mlcs4.x86_64.rpm
0fc514faf948500ec0137b44cc1a5389 corporate/4.0/x86_64/lib64ecpg5-devel-8.1.9-0.1.20060mlcs4.x86_64.rpm
bacb4bd2566d780a8932f529440ca2ff corporate/4.0/x86_64/lib64pq4-8.1.9-0.1.20060mlcs4.x86_64.rpm
0cc781b80d02284b7ed02e9992eb6703 corporate/4.0/x86_64/lib64pq4-devel-8.1.9-0.1.20060mlcs4.x86_64.rpm
d78cc609f0946a02f14afa7b966611c3 corporate/4.0/x86_64/postgresql-8.1.9-0.1.20060mlcs4.x86_64.rpm
b1d44b41d5c530e2ed8511ff675fb4c2 corporate/4.0/x86_64/postgresql-contrib-8.1.9-0.1.20060mlcs4.x86_64.rpm
8692be6eafa3456df3fa0a3d87de72cb corporate/4.0/x86_64/postgresql-devel-8.1.9-0.1.20060mlcs4.x86_64.rpm
53f92d03039e36039e3a1f72f334870f corporate/4.0/x86_64/postgresql-docs-8.1.9-0.1.20060mlcs4.x86_64.rpm
444849a87da50f7f0997d7bbca98eb52 corporate/4.0/x86_64/postgresql-pl-8.1.9-0.1.20060mlcs4.x86_64.rpm
3fc7ab8ac28d455c11bd383c325f7e34 corporate/4.0/x86_64/postgresql-plperl-8.1.9-0.1.20060mlcs4.x86_64.rpm
8d76936ae1bea76ca560f69de7f3ddbb corporate/4.0/x86_64/postgresql-plpgsql-8.1.9-0.1.20060mlcs4.x86_64.rpm
80d5cafaebc857bebda5c506d94d87c1 corporate/4.0/x86_64/postgresql-plpython-8.1.9-0.1.20060mlcs4.x86_64.rpm
b9b4c5a0146c879ce50bea68441d3984 corporate/4.0/x86_64/postgresql-pltcl-8.1.9-0.1.20060mlcs4.x86_64.rpm
ea9ca783a6c15724f19ac67b9481e7bd corporate/4.0/x86_64/postgresql-server-8.1.9-0.1.20060mlcs4.x86_64.rpm
b840ea84713a8e04d5344099c5f90e6b corporate/4.0/x86_64/postgresql-test-8.1.9-0.1.20060mlcs4.x86_64.rpm
ca8d689948255f7272231c30ac7b77e8 corporate/4.0/SRPMS/postgresql-8.1.9-0.1.20060mlcs4.src.rpm
_______________________________________________________________________
To upgrade automatically use MandrivaUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
All packages are signed by Mandriva for security. You can obtain the
GPG public key of the Mandriva Security Team by executing:
gpg --recv-keys --keyserver pgp.mit.edu 0x22458A98
You can view other update advisories for Mandriva Linux at:
http://www.mandriva.com/security/advisories
If you want to report vulnerabilities, please contact
security_(at)_mandriva.com
_______________________________________________________________________
Type Bits/KeyID Date User ID
pub 1024D/22458A98 2000-07-10 Mandriva Security Team
<security*mandriva.com>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (GNU/Linux)
iD8DBQFGL835mqjQ0CJFipgRAjiiAJ9uQ9EEMkDisMrGdi8BQCQpTJBEYACfcTpg
2BPKp+5JbNeOLrOsLTLoITY=
=XFMD
-----END PGP SIGNATURE-----
