SB2012100401 - Permissions, Privileges, and Access Controls in PostgreSQL

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2012100401

SB2012100401 - Permissions, Privileges, and Access Controls in PostgreSQL

Published: October 4, 2012 Updated: July 28, 2020

Security Bulletin ID SB2012100401
Severity
Low
Patch available
YES
Number of vulnerabilities 1
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Low 100%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 1 security vulnerability.


1) Permissions, Privileges, and Access Controls (CVE-ID: CVE-2012-3488)

The vulnerability allows a remote #AU# to read and manipulate data.

The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs, which allows remote authenticated users to modify data, obtain sensitive information, or trigger outbound traffic to arbitrary external hosts by leveraging (1) stylesheet commands that are permitted by the libxslt security options or (2) an xslt_process feature, related to an XML External Entity (aka XXE) issue.


Remediation

Install update from vendor's website.

References