postgresql: remote code execution [LWN.net]

Package(s):

postgresql

CVE #(s):

CAN-2003-0901

Created:

October 30, 2003

Updated:

November 17, 2003

Description:

Two bugs leading to a buffer overflow in the PostgreSQL RDBMS, versions 7.2.x and 7.3.x prior to 7.3.4, were discovered. The vulnerability exists in the PostgreSQL abstract data type (ADT) to ASCII conversion functions.

It has been conjectured that excessive data passed to the involved to_ascii_xxx() functions may overrun the bounds of an insufficient buffer reserved in heap memory, resulting in the corruption of heap based memory management structures that are adjacent to it. It is currently believed that under the correct circumstances an attacker may use this to execute arbitrary instructions in the context of the PostgreSQL server.

The Common Vulnerabilities and Exposures (CVE) project assigned the id CAN-2003-0901 to the problem.

Alerts:

Trustix	2003-0040	2003-11-15
Conectiva	CLA-2003:784	2003-11-13
Red Hat	RHSA-2003:313-00	2003-11-13
OpenPKG	OpenPKG-SA-2003.048	2003-11-11
Mandrake	MDKSA-2003:102	2003-11-03
OpenPKG	OpenPKG-SA-2003.047	2003-10-30

(Log in to post comments)