Information disclosure in PostgreSQL

1) Information disclosure

EUVDB-ID: #VU32375

Risk: Medium

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Green]

CVE-ID: CVE-2015-5288

CWE-ID: CWE-200 - Information exposure

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to #BASIC_IMPACT#.

The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause a denial of service (server crash) or read arbitrary server memory via a "too-short" salt.

Mitigation

Install update from vendor's website.

Vulnerable software versions

PostgreSQL: 9.0.0 - 9.4.4

CPE2.3

• cpe:2.3:a:postgresql_global_development_group:postgresql:9.0.22:*:*:*:*:*:*:*
• cpe:2.3:a:postgresql_global_development_group:postgresql:9.1.18:*:*:*:*:*:*:*
• cpe:2.3:a:postgresql_global_development_group:postgresql:9.2.13:*:*:*:*:*:*:*
• cpe:2.3:a:postgresql_global_development_group:postgresql:9.3.9:*:*:*:*:*:*:*
• cpe:2.3:a:postgresql_global_development_group:postgresql:9.4.4:*:*:*:*:*:*:*

External links

https://lists.fedoraproject.org/pipermail/package-announce/2015-November/172316.html
https://lists.fedoraproject.org/pipermail/package-announce/2015-October/169094.html
https://lists.opensuse.org/opensuse-security-announce/2016-03/msg00016.html
https://lists.opensuse.org/opensuse-updates/2015-11/msg00033.html
https://lists.opensuse.org/opensuse-updates/2015-11/msg00040.html
https://www.debian.org/security/2015/dsa-3374
https://www.debian.org/security/2016/dsa-3475
https://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
https://www.postgresql.org/about/news/1615/
https://www.postgresql.org/docs/9.0/static/release-9-0-23.html
https://www.postgresql.org/docs/9.1/static/release-9-1-19.html
https://www.postgresql.org/docs/9.2/static/release-9-2-14.html
https://www.postgresql.org/docs/9.3/static/release-9-3-10.html
https://www.postgresql.org/docs/9.4/static/release-9-4-5.html
https://www.securityfocus.com/bid/77049
https://www.securitytracker.com/id/1033775
https://www.ubuntu.com/usn/USN-2772-1
https://security.gentoo.org/glsa/201701-33

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected application in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.