Date: Thu, 30 Oct 2003 11:49:58 +0100
From: OpenPKG <[email protected]>
To: [email protected]Subject: [OpenPKG-SA-2003.047] OpenPKG Security Advisory (postgresql)
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
________________________________________________________________________
OpenPKG Security Advisory The OpenPKG Project
http://www.openpkg.org/security.htmlhttp://www.openpkg.org[email protected][email protected]
OpenPKG-SA-2003.047 30-Oct-2003
________________________________________________________________________
Package: postgresql
Vulnerability: remote code execution
OpenPKG Specific: no
Affected Releases: Affected Packages: Corrected Packages:
OpenPKG CURRENT <= postgresql-7.3.3-20030723 >= postgresql-7.3.4-20030725
OpenPKG 1.3 N.A. none
OpenPKG 1.2 <= postgresql-7.3.1-1.2.2 >= postgresql-7.3.1-1.2.3
Dependent Packages: none
Description:
Two bugs leading to a buffer overflow in the PostgreSQL [0] RDBMS,
versions 7.2.x and 7.3.x prior to 7.3.4, were discovered. The
vulnerability exists in the PostgreSQL abstract data type (ADT) to
ASCII conversion functions.
It has been conjectured that excessive data passed to the involved
to_ascii_xxx() functions may overrun the bounds of an insufficient
buffer reserved in heap memory, resulting in the corruption of heap
based memory management structures that are adjacent to it. It is
currently believed that under the correct circumstances an attacker
may use this to execute arbitrary instructions in the context of the
PostgreSQL server.
The Common Vulnerabilities and Exposures (CVE) project assigned the id
CAN-2003-0901 [1] to the problem.
Please check whether you are affected by running "<prefix>/bin/rpm -q
postgresql". If you have the "postgresql" package installed and its
version is affected (see above), we recommend that you immediately
upgrade it (see Solution). [2][3]
Solution:
Select the updated source RPM appropriate for the OpenPKG release
[4], fetch it from the OpenPKG FTP service [5] or a mirror location,
verify its integrity [6], build a corresponding binary RPM from it
[2] and update your OpenPKG installation by applying the binary RPM
[3]. For the release OpenPKG 1.2, perform the following operations
to permanently fix the security problem (for other releases adjust
accordingly).
$ ftp ftp.openpkg.org
ftp> bin
ftp> cd release/1.2/UPD
ftp> get postgresql-7.3.1-1.2.3.src.rpm
ftp> bye
$ <prefix>/bin/rpm -v --checksig postgresql-7.3.1-1.2.3.src.rpm
$ <prefix>/bin/rpm --rebuild postgresql-7.3.1-1.2.3.src.rpm
$ su -
# <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/postgresql-7.3.1-1.2.3.*.rpm
________________________________________________________________________
References:
[0] http://www.postgresql.org/
[1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0901
[2] http://www.openpkg.org/tutorial.html#regular-source
[3] http://www.openpkg.org/tutorial.html#regular-binary
[4] ftp://ftp.openpkg.org/release/1.2/UPD/postgresql-7.3.1-1.2.3.src.rpm
[5] ftp://ftp.openpkg.org/release/1.2/UPD/
[6] http://www.openpkg.org/security.html#signature
________________________________________________________________________
For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG <[email protected]>" (ID 63C4CB9F) of the
OpenPKG project which you can retrieve from http://pgp.openpkg.org and
hkp://pgp.openpkg.org. Follow the instructions on http://pgp.openpkg.org/
for details on how to verify the integrity of this advisory.
________________________________________________________________________
-----BEGIN PGP SIGNATURE-----
Comment: OpenPKG <[email protected]>
iD8DBQE/oOungHWT4GPEy58RAlPhAJ9sOmflrvsVKaKXsIhBO5QwH1RZpQCgzrSm
/YtFwDlJBS8SqrviUZQAcvU=
=Q4fx
-----END PGP SIGNATURE-----
