| Description: | Description:
The remote host is missing an update to postgresql
announced via advisory MDKSA-2005:040.
A number of vulnerabilities were found and corrected in the PostgreSQL
DBMS:
A flaw in the LOAD command could be abused by a local user to load
arbitrary shared libraries and as a result execute arbitrary code with
the privileges of the user running the postgresql server
(CVE-2005-0227).
A permission checking flaw was found where a local user could bypass
the EXECUTE permission check for functions using the CREATE AGGREGATE
command (CVE-2005-0244).
Multiple bufffer overflows were discovered in PL/PgSQL. A database
user with permission to create plpgsql functions could trigger these
flaws which could then lead to arbitrary code execution with the
privileges of the user running the postgresql server (CVE-2005-0245
and CVE-2005-0247).
Finally, a flaw in the integer aggregator (intagg) contrib module was
found. A user could create carefully crafted arrays and crash the
server, causing a Denial of Service (CVE-2005-0246).
The updated packages have been patched to correct these problems.
Affected versions: 10.0, 10.1, Corporate 3.0,
Corporate Server 2.1
Solution:
To upgrade automatically use MandrakeUpdate or urpmi. The verification
of md5 checksums and GPG signatures is performed automatically for you.
https://secure1.securityspace.com/smysecure/catid.html?in=MDKSA-2005:040
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0227
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0244
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0245
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0246
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2005-0247
Risk factor : High
CVSS Score:
7.5
|
