CVE-2009-3230

NameCVE-2009-3230
DescriptionThe core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.
SourceCVE (at NVD; oss-sec, fulldisc, OSVDB, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, more)
ReferencesDSA-1900-1
NVD severitymedium (attack range: remote)
Debian/oldoldstablenot vulnerable.
Debian/oldstablenot vulnerable.
Debian/stablenot known to be vulnerable.
Debian/testingnot known to be vulnerable.
Debian/unstablenot known to be vulnerable.

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
postgresql-8.4 (PTS)squeeze8.4.21-0squeeze1fixed
squeeze (security)8.4.20-0squeeze1fixed
squeeze (lts)8.4.22lts2-0+deb6u1fixed
wheezy8.4.22-0+deb7u1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
postgresql-7.4source(unstable)(unfixed)medium
postgresql-7.4sourceetch1:7.4.26-0etch1mediumDSA-1900-1
postgresql-8.1source(unstable)(unfixed)medium
postgresql-8.1sourceetch8.1.18-0etch1mediumDSA-1900-1
postgresql-8.3source(unstable)8.3.8-1medium
postgresql-8.3sourcelenny8.3.8-0lenny1mediumDSA-1900-1
postgresql-8.4source(unstable)8.4.1-1medium

Search for package or bug name: Reporting problems