FKIE_CVE-2009-3230

Vulnerability from fkie_nvd - Published: 2009-09-17 10:30 - Updated: 2025-04-09 00:30
Severity ?
Summary
The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.
References
cve@mitre.orghttp://archives.postgresql.org/pgsql-www/2009-09/msg00024.php
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
cve@mitre.orghttp://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
cve@mitre.orghttp://marc.info/?l=bugtraq&m=134124585221119&w=2
cve@mitre.orghttp://secunia.com/advisories/36660Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/36695Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/36727Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/36800
cve@mitre.orghttp://secunia.com/advisories/36837
cve@mitre.orghttp://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1
cve@mitre.orghttp://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
cve@mitre.orghttp://www.postgresql.org/docs/8.3/static/release-8-3-8.htmlVendor Advisory
cve@mitre.orghttp://www.postgresql.org/support/security.htmlVendor Advisory
cve@mitre.orghttp://www.securityfocus.com/archive/1/509917/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/36314
cve@mitre.orghttp://www.ubuntu.com/usn/usn-834-1
cve@mitre.orghttp://www.us.debian.org/security/2009/dsa-1900
cve@mitre.orghttp://www.vupen.com/english/advisories/2009/2602Vendor Advisory
cve@mitre.orghttps://bugzilla.redhat.com/show_bug.cgi?id=522085
cve@mitre.orghttps://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10166
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
cve@mitre.orghttps://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html
af854a3a-2127-422b-91ae-364da2661108http://archives.postgresql.org/pgsql-www/2009-09/msg00024.php
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
af854a3a-2127-422b-91ae-364da2661108http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
af854a3a-2127-422b-91ae-364da2661108http://marc.info/?l=bugtraq&m=134124585221119&w=2
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36660Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36695Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36727Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36800
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/36837
af854a3a-2127-422b-91ae-364da2661108http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1
af854a3a-2127-422b-91ae-364da2661108http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
af854a3a-2127-422b-91ae-364da2661108http://www.postgresql.org/docs/8.3/static/release-8-3-8.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.postgresql.org/support/security.htmlVendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/509917/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/36314
af854a3a-2127-422b-91ae-364da2661108http://www.ubuntu.com/usn/usn-834-1
af854a3a-2127-422b-91ae-364da2661108http://www.us.debian.org/security/2009/dsa-1900
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2009/2602Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://bugzilla.redhat.com/show_bug.cgi?id=522085
af854a3a-2127-422b-91ae-364da2661108https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10166
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
af854a3a-2127-422b-91ae-364da2661108https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html
Impacted products
Vendor Product Version
postgresql postgresql 7.4
postgresql postgresql 7.4.1
postgresql postgresql 7.4.2
postgresql postgresql 7.4.3
postgresql postgresql 7.4.4
postgresql postgresql 7.4.5
postgresql postgresql 7.4.6
postgresql postgresql 7.4.7
postgresql postgresql 7.4.8
postgresql postgresql 7.4.9
postgresql postgresql 7.4.10
postgresql postgresql 7.4.11
postgresql postgresql 7.4.12
postgresql postgresql 7.4.13
postgresql postgresql 7.4.14
postgresql postgresql 7.4.15
postgresql postgresql 7.4.16
postgresql postgresql 7.4.17
postgresql postgresql 7.4.18
postgresql postgresql 7.4.19
postgresql postgresql 7.4.20
postgresql postgresql 7.4.21
postgresql postgresql 7.4.22
postgresql postgresql 7.4.23
postgresql postgresql 7.4.24
postgresql postgresql 7.4.25
postgresql postgresql 8.0
postgresql postgresql 8.0.1
postgresql postgresql 8.0.2
postgresql postgresql 8.0.3
postgresql postgresql 8.0.4
postgresql postgresql 8.0.5
postgresql postgresql 8.0.6
postgresql postgresql 8.0.7
postgresql postgresql 8.0.8
postgresql postgresql 8.0.9
postgresql postgresql 8.0.10
postgresql postgresql 8.0.11
postgresql postgresql 8.0.12
postgresql postgresql 8.0.13
postgresql postgresql 8.0.14
postgresql postgresql 8.0.15
postgresql postgresql 8.0.16
postgresql postgresql 8.0.17
postgresql postgresql 8.0.18
postgresql postgresql 8.0.19
postgresql postgresql 8.0.20
postgresql postgresql 8.0.21
postgresql postgresql 8.1
postgresql postgresql 8.1.1
postgresql postgresql 8.1.2
postgresql postgresql 8.1.3
postgresql postgresql 8.1.4
postgresql postgresql 8.1.5
postgresql postgresql 8.1.6
postgresql postgresql 8.1.7
postgresql postgresql 8.1.8
postgresql postgresql 8.1.9
postgresql postgresql 8.1.10
postgresql postgresql 8.1.11
postgresql postgresql 8.1.12
postgresql postgresql 8.1.13
postgresql postgresql 8.1.14
postgresql postgresql 8.1.15
postgresql postgresql 8.1.16
postgresql postgresql 8.2
postgresql postgresql 8.2.1
postgresql postgresql 8.2.2
postgresql postgresql 8.2.3
postgresql postgresql 8.2.4
postgresql postgresql 8.2.5
postgresql postgresql 8.2.6
postgresql postgresql 8.2.7
postgresql postgresql 8.2.8
postgresql postgresql 8.2.9
postgresql postgresql 8.2.10
postgresql postgresql 8.2.11
postgresql postgresql 8.2.12
postgresql postgresql 8.2.13
postgresql postgresql 8.3.1
postgresql postgresql 8.3.2
postgresql postgresql 8.3.3
postgresql postgresql 8.3.4
postgresql postgresql 8.3.5
postgresql postgresql 8.3.6
postgresql postgresql 8.3.7
postgresql postgresql 8.4

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "FBE2567C-BF48-4255-9E56-590A6F9DD932",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "0C8DDD98-9A2D-402D-9172-F3C4C4C97FEF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "20C8302B-631A-4DF7-839B-C6F3CC39E000",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "FB318EB9-1B49-452A-92CF-89D9BA990AB9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "5913A53B-7B72-4CBD-ADAE-318333EB8B7B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "815E58C0-327D-4F14-B496-05FC8179627E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "3EF2D056-5120-4F98-8343-4EC31F962CFE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "516E0E86-3D8A-43F9-9DD5-865F5C889FC4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "5A7A9D3C-4BB6-4974-BF96-6E6728196F4E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "486EDE1B-37E0-4DDF-BFC9-C8C8945D5E2A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "A7FC7F18-B227-4C46-9A33-FB34DDE456CC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCDB903F-0C89-4E65-857E-553CF9C192E8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "F6BF8B1E-68F7-4F27-AD1F-FA02B256BDAA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD0DEB63-CA70-44C1-9491-E0790D1A8E21",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "DA8E73E5-BA41-4FA2-8457-803A97FB00C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "4C9B64CA-778F-405D-A441-34599246A3F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "4975D8ED-7DCB-430F-98E1-DB165D6DA7E1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "CCBF8CDE-5E75-4DF8-AE1A-B7377953917A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "8AC4A04B-738C-4018-BB2F-FBEC8746200C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "36A2824A-A43F-436B-B9DA-B7E283A00426",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "DBBAF0F1-7A70-41DC-89A7-2EF9851E4FC0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "4A12EC07-1938-41BF-BCFC-C269668F1EBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.22:*:*:*:*:*:*:*",
              "matchCriteriaId": "14D7CE0D-510C-46BB-8896-42DD84F57017",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.23:*:*:*:*:*:*:*",
              "matchCriteriaId": "1AA5858F-7DFF-460D-B862-83DD636D0A36",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.24:*:*:*:*:*:*:*",
              "matchCriteriaId": "4394564D-131D-41C8-AE3A-BFF44779F27B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:7.4.25:*:*:*:*:*:*:*",
              "matchCriteriaId": "2CCC06DB-1C93-4DE5-AEDC-03E532DA89F9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "94222D76-82BE-4FFB-BE4B-5DBAF3080D4D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "91D1232E-4D0A-4BDC-99F6-25AEE014E9AE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "105E9F52-D17E-4A0B-9C46-FD32A930B1E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "0DE2055D-AAA4-4A6A-918F-349A9749AF09",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "C12409B2-161B-4F78-B7AD-3CF69DDCC574",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "DD2F1DA4-6625-469D-988B-5457B68851A9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "870F4348-6001-4C2F-A547-61964074E7C0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2E26D52-D95A-4547-BE6E-4F142F54A624",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "4AAB2D1D-BE61-4D7C-B305-58B4F4126620",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A5F8D8B-34C5-4EBC-BB20-4D11191238B5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "E260F1F9-0068-4289-A8E8-C30220C2E1F7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "EEE16023-9A5E-46D5-B597-E6885C224786",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "84D64D74-9645-4CB7-B710-4FC26FB65B37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "BCF2794E-6B48-496B-B6CA-CDC7FC2160CA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "8EB12063-F487-4067-A7A5-4482E19D8D14",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "51AE5B72-DDC5-4207-B467-A9583F3AC781",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "99398182-C98C-4B16-9DBA-B1980BDFFA54",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.17:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6FEC1DE-A2A5-4945-95B8-75FDC9ED3B63",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.18:*:*:*:*:*:*:*",
              "matchCriteriaId": "264AB44D-D014-4734-B538-09E5834EC30B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.19:*:*:*:*:*:*:*",
              "matchCriteriaId": "8D5DD1E6-E190-4D75-9D27-5EFB2544B158",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.20:*:*:*:*:*:*:*",
              "matchCriteriaId": "3CD7F8CA-09B3-4038-B8B0-2D62A77F2478",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.0.21:*:*:*:*:*:*:*",
              "matchCriteriaId": "64815C3D-1A1A-4525-9BCD-D89BAEACC950",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "2AF590F2-899F-42E1-8A57-6F514C94CE4F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "FEEC35A2-B17C-46EC-8697-9E03568339BC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "00562C18-DD81-4B09-AF93-739AF8757A12",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "6B52D093-7867-4FE8-B055-D8190103A1E6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "DF1A06EE-26BD-4CDA-AEB9-01124FC37E37",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "FF855730-C61C-4FDC-96CB-57775A903421",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "D93296E1-AEA2-443E-B9AA-D70535DDD093",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "992C3EC0-4C12-4FB0-8844-9EFB91DA95E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "8E3EBF1D-D5BD-4A22-B76A-2BAB21534E70",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "02DC4E8A-A728-4734-B67A-C58C37DA90C1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "D59B0E32-9E71-4E41-BBAF-7A20008E43E4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA6511DE-AF52-4953-8394-37D24A732538",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "51B93DC5-F632-47A5-9C58-52429B034D1A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "D011C676-47D3-4D78-9C58-749AF6C7DBDE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.14:*:*:*:*:*:*:*",
              "matchCriteriaId": "DFD5BE40-CF55-4C0E-BD89-5CC7DF41F6BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.15:*:*:*:*:*:*:*",
              "matchCriteriaId": "7C1EE1C3-4472-4CE2-AB60-9535C1C4AF8B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.1.16:*:*:*:*:*:*:*",
              "matchCriteriaId": "3B903334-2F67-4725-8277-6913E03BEFC3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "7213327F-6909-43A7-952E-11600C28D4E3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "10EF0EA6-C8B6-40A7-A3AE-8639CA94D5C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "D9F645F3-9767-4FD8-94EB-1096DF24E6C3",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C342A823-EF6F-4557-9F9E-D8893EA4C2BA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "B85A443F-0802-412F-9AEE-3525311C93D4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "06253BA8-7F1E-4C79-9B2E-197307A627F0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "2A213AB8-A5FE-4062-B895-2FC4B19F60A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "9A3F083E-59A8-41B1-826F-2CA39BD425C9",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.8:*:*:*:*:*:*:*",
              "matchCriteriaId": "DE49E2D5-8EAC-49C7-B704-E626FBE7EC35",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.9:*:*:*:*:*:*:*",
              "matchCriteriaId": "A5059B2F-B588-463E-8E96-BC9DA129C12E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.10:*:*:*:*:*:*:*",
              "matchCriteriaId": "C919AF97-9713-44F8-B742-89C438DB0B48",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.11:*:*:*:*:*:*:*",
              "matchCriteriaId": "400BBC62-5D03-465B-A864-9CD479B963F8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.12:*:*:*:*:*:*:*",
              "matchCriteriaId": "BC8C96F7-7F85-4E47-A05F-15E3C70AF583",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.2.13:*:*:*:*:*:*:*",
              "matchCriteriaId": "6C236CF1-72C0-4C3D-AE04-B67E3F18EEC8",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.3.1:*:*:*:*:*:*:*",
              "matchCriteriaId": "05AD5D33-86F4-4BFF-BA84-02AA1347BEEB",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.3.2:*:*:*:*:*:*:*",
              "matchCriteriaId": "02FDCF30-D0F7-48AA-9633-9CC060495F47",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.3.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "788975F6-B3F1-4C21-B963-6BA59F14B71C",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.3.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "E6713D96-338B-4467-9F05-3153997F62E2",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.3.5:*:*:*:*:*:*:*",
              "matchCriteriaId": "01EB1A77-92AD-47FB-8290-D05C9B6C19C4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:*",
              "matchCriteriaId": "74857259-30C7-422D-A24D-BE1E33F09466",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.3.7:*:*:*:*:*:*:*",
              "matchCriteriaId": "CD80066B-787E-496B-88FD-F0AE291468C5",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:8.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "8F30CA60-0A82-45CD-8044-CE245393593D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges.  NOTE: this is due to an incomplete fix for CVE-2007-6600."
    },
    {
      "lang": "es",
      "value": "El componente core server en PostgreSQL desde v8.4 anteriores a v8.4.1, desde v8.3 anteriores a v8.3.8, desde v8.2 anteriores a v8.2.14, desde v8.1 anteriores a v8.1.18, desde v8.0 anteriores a v8.0.22, y v7.4 anteriores a v7.4.26 no maneja adecuadamente los privilegios para las operaciones (1)BORRADO DE ROL (2)BORRADO DE AUTORIZACI\u00d3N DE SESI\u00d3N, lo que permite a usuarios remotos autenticados ganar privilegios. NOTA: Esto es debido a un arreglo incompleto de CVE-2007-6600."
    }
  ],
  "id": "CVE-2009-3230",
  "lastModified": "2025-04-09T00:30:58.490",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2009-09-17T10:30:00.967",
  "references": [
    {
      "source": "cve@mitre.org",
      "url": "http://archives.postgresql.org/pgsql-www/2009-09/msg00024.php"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://marc.info/?l=bugtraq\u0026m=134124585221119\u0026w=2"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36660"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36695"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36727"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/36800"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://secunia.com/advisories/36837"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.postgresql.org/docs/8.3/static/release-8-3-8.html"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.postgresql.org/support/security.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/509917/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/36314"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.ubuntu.com/usn/usn-834-1"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.us.debian.org/security/2009/dsa-1900"
    },
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/2602"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=522085"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10166"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://archives.postgresql.org/pgsql-www/2009-09/msg00024.php"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://marc.info/?l=bugtraq\u0026m=134124585221119\u0026w=2"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36660"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36695"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/36727"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/36800"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://secunia.com/advisories/36837"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://sunsolve.sun.com/search/document.do?assetkey=1-66-270408-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.postgresql.org/docs/8.3/static/release-8-3-8.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.postgresql.org/support/security.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/509917/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/36314"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.ubuntu.com/usn/usn-834-1"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.us.debian.org/security/2009/dsa-1900"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://www.vupen.com/english/advisories/2009/2602"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://bugzilla.redhat.com/show_bug.cgi?id=522085"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10166"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-264"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading…

Loading…

Loading…

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Loading…

Detection rules are retrieved from Rulezet.

Loading…

Loading…