Updated Red Hat Database packages available

Updated Red Hat Database packages are available. These packages correct
several bugs and a security vulnerability.

Versions of PostgreSQL 6.5.x to 7.1.3 are vulnerable to a security issue.

Due to a bug in PostgreSQL's multi-byte support, users of any database
client application that builds database queries from user input may enable
a user to cause the database server to execute arbitrary SQL commands. Red
Hat Database 7.1 is based on PostgreSQL 7.1 and is vulnerable to this
attack. Details of the vulnerability are as follows:

If a client using a character encoding other than SQL_ASCII passes a query
to a multi-byte enabled database server using the default SQL_ASCII
encoding, then any character in the query string not representable by the
SQL_ASCII encoding will cause the character immediately following the
unrepresentable character to be lost during character set conversion.

Some applications form their SQL queries by populating a template query
with text input from the user. This character conversion bug can be used by
an attacker to suppress characters in the application's template query
string and force user input components of a database query to be
interpreted only as literal text. It is then possible for the user input
data to be interpreted as query text, resulting in the execution of
arbitrary SQL.

Red Hat Database 7.1 shipped with a vulnerable version of PostgreSQL and
has multi-byte support enabled by default. This update incorporates the
patch for this issue as provided by Tatsuo Ishii on the pgsql-hackers
mailing list.

This update also contains fixes for several PostgreSQL bugs, including
problems related to write-ahead logging (WAL) of sequences,
backup with pg_dump of user defined aggregates that have a null initial
condition, and handling of long literals in plpgsql.

All users of Red Hat Database are advised to apply this update to remedy
the outlined vulnerability.

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

To update all RPMs for your particular architecture, run:

rpm -Fvh [filenames]

where [filenames] is a list of the RPMs you wish to upgrade. Only those
RPMs which are currently installed will be updated. Those RPMs which are
not installed but included in the list will not be updated. Note that you
can also use wildcards (*.rpm) if your current directory *only* contains
the desired RPMs.

Please note that this update is also available via Red Hat Network. Many
people find this an easier way to apply updates. To use Red Hat Network,
launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2002-0802
http://marc.theaimsgroup.com/?l=postgresql-general&m=102032794322362
http://archives.postgresql.org/pgsql-hackers/2002-05/msg00039.php

multi-byte, PostgreSQL, RHDB, SQL_ASCII