Debian update for postgresql-9.6



Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2017-15098
CVE-2017-15099
CWE-ID CWE-19
CWE-264
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Debian Linux
Operating systems & Components / Operating system

Vendor Debian

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Data handling

EUVDB-ID: #VU9168

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15098

CWE-ID: CWE-19 - Data Handling

Exploit availability: No

Description

The vulnerability allows a remote authenticated attacker to cause DoS condition or obtain potentially sensitive information on a targeted system.

The weakness exists due to improper data handling. A remote attacker can send specially crafted data to trigger a rowtype mismatch in json{b}_populate_recordset(), cause the application to crash or read arbitrary data.

Mitigation

Update the affected package to version: 9.6.6-0+deb9u1

Vulnerable software versions

Debian Linux: All versions

CPE2.3 External links

https://www.postgresql.org/docs/current/static/release-9-6-6.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Security restrictions bypass

EUVDB-ID: #VU9167

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2017-15099

CWE-ID: CWE-264 - Permissions, Privileges, and Access Controls

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass security restrictions on a targeted system.

The weakness exists due to improper security restrictions in the case of an arbiter specified by constraint name. A remote attacker can submit specially crafted INSERT requests and bypass security controls on the update path of 'INSERT ... ON CONFLICT DO UPDATE' function to conduct further attacks.

Mitigation

Update the affected package to version: 9.6.6-0+deb9u1

Vulnerable software versions

Debian Linux: All versions

CPE2.3 External links

https://www.postgresql.org/docs/current/static/release-9-6-6.html


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###