Debian Bug report logs - #293125
postgresql: LOAD security issue

version graph

Package: postgresql; Maintainer for postgresql is Debian PostgreSQL Maintainers <pkg-postgresql-public@lists.alioth.debian.org>; Source for postgresql is src:postgresql-common.

Reported by: Florian Weimer <fw@deneb.enyo.de>

Date: Tue, 1 Feb 2005 09:48:04 UTC

Severity: grave

Tags: fixed, security, woody

Found in version 7.4.6-7

Fixed in version postgresql/7.4.7-1

Done: Martin Pitt <mpitt@debian.org>

Bug is archived. No further changes may be made.

Toggle useless messages

View this report as an mbox folder, status mbox, maintainer mbox


Report forwarded to debian-bugs-dist@lists.debian.org, Martin Pitt <mpitt@debian.org>:
Bug#293125; Package postgresql. Full text and rfc822 format available.

Acknowledgement sent to Florian Weimer <fw@deneb.enyo.de>:
New Bug report received and forwarded. Copy sent to Martin Pitt <mpitt@debian.org>. Full text and rfc822 format available.

Message #5 received at submit@bugs.debian.org (full text, mbox):

From: Florian Weimer <fw@deneb.enyo.de>
To: Debian Bug Tracking System <submit@bugs.debian.org>
Subject: postgresql: LOAD security issue
Date: Tue, 01 Feb 2005 10:44:15 +0100
Package: postgresql
Version: 7.4.6-7
Severity: grave
Tags: security
Justification: user security hole

Upstream has released new versions because of the LOAD security hole:

  <http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php>
  <http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php>

-- System Information:
Debian Release: 3.1
  APT prefers unstable
  APT policy: (800, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.11-rc1fw
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)

Versions of packages postgresql depends on:
ii  adduser          3.59                    Add and remove users and groups
ii  debconf [debconf 1.4.42                  Debian configuration management sy
ii  debianutils      2.11.2                  Miscellaneous utilities specific t
ii  libc6            2.3.2.ds1-20            GNU C Library: Shared libraries an
ii  libcomerr2       1.36rc2-1               common error description library
ii  libkrb53         1.3.6-1                 MIT Kerberos runtime libraries
ii  libpam0g         0.76-22                 Pluggable Authentication Modules l
ii  libperl5.8       5.8.4-5                 Shared Perl library
ii  libpq3           7.4.6-6                 PostgreSQL C client library
ii  libreadline4     4.3-15                  GNU readline and history libraries
ii  libssl0.9.7      0.9.7e-3                SSL shared libraries
ii  mailx            1:8.1.2-0.20040524cvs-4 A simple mail user agent
pn  postgresql-clien                         Not found.
ii  procps           1:3.2.4-1               The /proc file system utilities
ii  python2.3        2.3.4-19                An interactive high-level object-o
ii  ucf              1.13                    Update Configuration File: preserv
ii  zlib1g           1:1.2.2-4               compression library - runtime



Tags added: woody, sarge, sid Request was from Martin Pitt <martin.pitt@ubuntu.com> to control@bugs.debian.org. Full text and rfc822 format available.

Tags added: pending Request was from Martin Pitt <martin.pitt@ubuntu.com> to control@bugs.debian.org. Full text and rfc822 format available.

Reply sent to Martin Pitt <mpitt@debian.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Florian Weimer <fw@deneb.enyo.de>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #14 received at 293125-close@bugs.debian.org (full text, mbox):

From: Martin Pitt <mpitt@debian.org>
To: 293125-close@bugs.debian.org
Subject: Bug#293125: fixed in postgresql 7.4.7-1
Date: Tue, 01 Feb 2005 20:02:24 -0500
Source: postgresql
Source-Version: 7.4.7-1

We believe that the bug you reported is fixed in the latest version of
postgresql, which is due to be installed in the Debian FTP archive:

libecpg-dev_7.4.7-1_i386.deb
  to pool/main/p/postgresql/libecpg-dev_7.4.7-1_i386.deb
libecpg4_7.4.7-1_i386.deb
  to pool/main/p/postgresql/libecpg4_7.4.7-1_i386.deb
libpgtcl-dev_7.4.7-1_i386.deb
  to pool/main/p/postgresql/libpgtcl-dev_7.4.7-1_i386.deb
libpgtcl_7.4.7-1_i386.deb
  to pool/main/p/postgresql/libpgtcl_7.4.7-1_i386.deb
libpq3_7.4.7-1_i386.deb
  to pool/main/p/postgresql/libpq3_7.4.7-1_i386.deb
postgresql-client_7.4.7-1_i386.deb
  to pool/main/p/postgresql/postgresql-client_7.4.7-1_i386.deb
postgresql-contrib_7.4.7-1_i386.deb
  to pool/main/p/postgresql/postgresql-contrib_7.4.7-1_i386.deb
postgresql-dev_7.4.7-1_i386.deb
  to pool/main/p/postgresql/postgresql-dev_7.4.7-1_i386.deb
postgresql-doc_7.4.7-1_all.deb
  to pool/main/p/postgresql/postgresql-doc_7.4.7-1_all.deb
postgresql_7.4.7-1.diff.gz
  to pool/main/p/postgresql/postgresql_7.4.7-1.diff.gz
postgresql_7.4.7-1.dsc
  to pool/main/p/postgresql/postgresql_7.4.7-1.dsc
postgresql_7.4.7-1_i386.deb
  to pool/main/p/postgresql/postgresql_7.4.7-1_i386.deb
postgresql_7.4.7.orig.tar.gz
  to pool/main/p/postgresql/postgresql_7.4.7.orig.tar.gz



A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 293125@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Martin Pitt <mpitt@debian.org> (supplier of updated postgresql package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)


-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Tue,  1 Feb 2005 12:23:04 +0100
Source: postgresql
Binary: postgresql-client libecpg4 libpgtcl-dev libpq3 postgresql-doc libecpg-dev postgresql-dev postgresql libpgtcl postgresql-contrib
Architecture: source i386 all
Version: 7.4.7-1
Distribution: unstable
Urgency: high
Maintainer: Martin Pitt <mpitt@debian.org>
Changed-By: Martin Pitt <mpitt@debian.org>
Description: 
 libecpg-dev - development files for ECPG (Embedded PostgreSQL for C)
 libecpg4   - run-time library for ECPG programs
 libpgtcl   - Tcl procedural language, library and front-end for PostgreSQL
 libpgtcl-dev - Tcl library for PostgreSQL - development files
 libpq3     - PostgreSQL C client library
 postgresql - object-relational SQL database management system
 postgresql-client - front-end programs for PostgreSQL
 postgresql-contrib - additional facilities for PostgreSQL
 postgresql-dev - development files for libpq (PostgreSQL library)
 postgresql-doc - documentation for the PostgreSQL database management system
Closes: 262081 293125
Changes: 
 postgresql (7.4.7-1) unstable; urgency=high
 .
   * New upstream bug fix release. Fixes a local privilege escalation:
     low-privileged users could use LOAD to load any shared library into the
     PostgreSQL server; its initialisation function was then executed with the
     permissions of the server. Closes: #293125
     See http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php
   * Removed the following patches (now in upstream source):
     - debian/patches/13frenchpo,
     - debian/patches/14emptyarrays
   * Applied some portability enhancements to work on GNU/Hurd and GNU/k*BSD,
     thanks to Robert Millan:
     - debian/startup-checks-root.sh: Use "sysctl" instead of direct /proc
       access to read kernel variables.
     - debian/rules: configure with --with-template=linux
     Closes: #262081
Files: 
 5e5a253307750faf8beedbbd0d59ad6e 973 misc optional postgresql_7.4.7-1.dsc
 d193c58aef02a745e8657c48038587ac 9952102 misc optional postgresql_7.4.7.orig.tar.gz
 fb4ee0a3607f1ce2417329599617978d 148925 misc optional postgresql_7.4.7-1.diff.gz
 2cb4caaa3051df8c8d6d1e1a5304ee8a 2391924 doc optional postgresql-doc_7.4.7-1_all.deb
 cb4fc592b533fbc2cb155cc9b0483f73 3792256 misc optional postgresql_7.4.7-1_i386.deb
 50a1330c384168e8dd7c0853cbbf85a5 536904 misc optional postgresql-client_7.4.7-1_i386.deb
 2daec96e18e18b02049bcab424b63a79 512102 libdevel optional postgresql-dev_7.4.7-1_i386.deb
 0a2927155f2338afdb6a0f3c7e62e98c 124126 libs optional libpq3_7.4.7-1_i386.deb
 09dbbc49ae2a6146a9607727baa91ab1 93114 libs optional libecpg4_7.4.7-1_i386.deb
 3ada9f418147398d5d1289e5d20471eb 204392 libdevel optional libecpg-dev_7.4.7-1_i386.deb
 e46b7d18702bf0a26faf5fe080d4d3c5 75134 libs optional libpgtcl_7.4.7-1_i386.deb
 01fd0e62792e81ff1db2bd5b4146f612 52966 libdevel optional libpgtcl-dev_7.4.7-1_i386.deb
 47f8527d139425d6feeb53281f93b859 619314 misc optional postgresql-contrib_7.4.7-1_i386.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFCACCjDecnbV4Fd/IRAlrHAJ46tCv3h7x4gvr7Kqlw+o2+ewy/TgCfWPT3
QYKdTffezQUNW5cv9fOhPsU=
=ERu2
-----END PGP SIGNATURE-----




Information forwarded to debian-bugs-dist@lists.debian.org, Martin Pitt <mpitt@debian.org>:
Bug#293125; Package postgresql. Full text and rfc822 format available.

Acknowledgement sent to Helge Kreutzmann <kreutzm@itp.uni-hannover.de>:
Extra info received and forwarded to list. Copy sent to Martin Pitt <mpitt@debian.org>. Full text and rfc822 format available.

Message #19 received at 293125@bugs.debian.org (full text, mbox):

From: Helge Kreutzmann <kreutzm@itp.uni-hannover.de>
To: 293125@bugs.debian.org
Subject: Is woody impacted?
Date: Wed, 2 Feb 2005 11:40:45 +0100
[Message part 1 (text/plain, inline)]
Hello,
the tags indicate that woodys postgresql is impacted as well. The
latest entry in the changelog is, however, from 26 Oct 2004, and
reading the bug report I did not find a indication to the contrary.

Please reopen if a DSA is forthcoming. Thanks.

Greetings

          Helge
-- 
Helge Kreutzmann, Dipl.-Phys.               Helge.Kreutzmann@itp.uni-hannover.de
                       gpg signed mail preferred 
    64bit GNU powered                  http://www.itp.uni-hannover.de/~kreutzm
       Help keep free software "libre": http://www.freepatents.org/
[Message part 2 (application/pgp-signature, inline)]

Bug reopened, originator not changed. Request was from Martin Pitt <martin.pitt@ubuntu.com> to control@bugs.debian.org. Full text and rfc822 format available.

Tags removed: sarge, sid Request was from Martin Pitt <martin.pitt@ubuntu.com> to control@bugs.debian.org. Full text and rfc822 format available.

Tags added: pending Request was from Martin Pitt <martin.pitt@ubuntu.com> to control@bugs.debian.org. Full text and rfc822 format available.

Reply sent to Martin Pitt <mpitt@debian.org>:
You have taken responsibility. Full text and rfc822 format available.

Notification sent to Florian Weimer <fw@deneb.enyo.de>:
Bug acknowledged by developer. Full text and rfc822 format available.

Message #30 received at 293125-done@bugs.debian.org (full text, mbox):

From: Martin Pitt <mpitt@debian.org>
To: 293125-done@bugs.debian.org
Subject: Woody update was published
Date: Thu, 10 Feb 2005 13:07:52 +0100
[Message part 1 (text/plain, inline)]
Woody has now a fixed version as well, thus this bug can be closed.

Martin
-- 
Martin Pitt                       http://www.piware.de
Ubuntu Developer            http://www.ubuntulinux.org
Debian GNU/Linux Developer       http://www.debian.org
[signature.asc (application/pgp-signature, inline)]

Tags added: fixed Request was from Martin Pitt <mpitt@debian.org> to control@bugs.debian.org. Full text and rfc822 format available.

Send a report that this bug log contains spam.


Debian bug tracking system administrator <owner@bugs.debian.org>. Last modified: Sat Apr 19 01:17:17 2014; Machine Name: buxtehude.debian.org

Debian Bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.