Skip to navigation

Security Advisory Updated PostgreSQL packages fix buffer overrun vulnerabilities

Advisory: RHSA-2003:010-10
Type: Security Advisory
Severity: N/A
Issued on: 2003-01-14
Last updated on: 2003-01-14
Affected Products: Red Hat Linux 6.2
Red Hat Linux 7.0
Red Hat Linux 7.1
Red Hat Linux 7.2
CVEs (cve.mitre.org): CVE-2002-0972
CVE-2002-1397
CVE-2002-1398
CVE-2002-1400
CVE-2002-1401
CVE-2002-1402

Details

Updated PostgreSQL packages are available for Red Hat Linux 6.2, 7, 7.1,
and 7.2 where we have backported a number of security fixes. A separate
advisory deals with updated PostgreSQL packages for Red Hat Linux 7.3 and 8.0.

PostgreSQL is an advanced Object-Relational database management system
(DBMS). A number of security issues have been found that affect PostgreSQL
versions shipped with Red Hat Linux.

Buffer overflows in PostgreSQL 7.2 allow attackers to cause a denial of
service and possibly execute arbitrary code via long arguments to the lpad
or rpad functions. CAN-2002-0972

Buffer overflow in the cash_words() function for PostgreSQL 7.2 and
earlier allows local users to cause a denial of service and possibly
execute arbitrary code via a malformed argument. CAN-2002-1397

Buffer overflow in the date parser for PostgreSQL before 7.2.2 allows
attackers to cause a denial of service and possibly execute arbitrary
code via a long date string, also known as a vulnerability "in handling
long datetime input." CAN-2002-1398

Heap-based buffer overflow in the repeat() function for PostgreSQL
before 7.2.2 allows attackers to execute arbitrary code by causing
repeat() to generate a large string. CAN-2002-1400

Buffer overflows in circle_poly, path_encode and path_add allow attackers
to cause a denial of service and possibly execute arbitrary code. Note
that these issues have been fixed in our packages and in PostgreSQL CVS,
but are not included in PostgreSQL version 7.2.2 or 7.2.3. CAN-2002-1401

Buffer overflows in the TZ and SET TIME ZONE enivronment variables for
PostgreSQL 7.2.1 and earlier allow local users to cause a denial of service
and possibly execute arbitrary code. CAN-2002-1402

Note that these vulnerabilities are only critical on open or shared systems
because connecting to the database is required before the vulnerabilities
can be exploited.

The PostgreSQL Global Development Team has released versions of PostgreSQL
that fixes these vulnerabilities, and these fixes have been isolated and
backported to the various versions of PostgreSQL that originally shipped
with each Red Hat Linux distribution. All users of PostgreSQL are advised
to install these updated packages.


Solution

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

Please note that this update is available via Red Hat Network. To use Red
Hat Network, launch the Red Hat Update Agent with the following command:

up2date

This will start an interactive process that will result in the appropriate
RPMs being upgraded on your system.

Note that no initdb will be necessary from previous PostgreSQL packages.

Updated packages

Red Hat Linux 6.2

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/postgresql/6.5.3-7.3/SRPMS/postgresql-6.5.3-7.3.src.rpm
Missing file
    MD5: 732b8eae39abc767f205a1b3cf16ab77
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/postgresql/6.5.3-7.3/i386/postgresql-6.5.3-7.3.i386.rpm
Missing file
    MD5: e7409539b4793a88f6ca068c67ad930a
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-devel/6.5.3-7.3/i386/postgresql-devel-6.5.3-7.3.i386.rpm
Missing file
    MD5: 8af6a1d62449e06d397bf4996a3f510e
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-jdbc/6.5.3-7.3/i386/postgresql-jdbc-6.5.3-7.3.i386.rpm
Missing file
    MD5: 110007dd317f9b1ae7b0554c1713e3a4
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-odbc/6.5.3-7.3/i386/postgresql-odbc-6.5.3-7.3.i386.rpm
Missing file
    MD5: 17dcc19ff76f273110fbac5a0208e512
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-perl/6.5.3-7.3/i386/postgresql-perl-6.5.3-7.3.i386.rpm
Missing file
    MD5: 971bc763d760f8b115fba9298521e96a
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-python/6.5.3-7.3/i386/postgresql-python-6.5.3-7.3.i386.rpm
Missing file
    MD5: b24f8d7e80ee9ab3c8e373adab507256
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-server/6.5.3-7.3/i386/postgresql-server-6.5.3-7.3.i386.rpm
Missing file
    MD5: 3024dd8f8628b7af20218d6f3891d2ec
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-tcl/6.5.3-7.3/i386/postgresql-tcl-6.5.3-7.3.i386.rpm
Missing file
    MD5: 6616e93a6b7a29930aa8414d812beb24
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-test/6.5.3-7.3/i386/postgresql-test-6.5.3-7.3.i386.rpm
Missing file
    MD5: 194d0ce61f98f52dd1baf56bbd6443a8
 
Red Hat Linux 7.0

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/postgresql/7.0.2-18.2/SRPMS/postgresql-7.0.2-18.2.src.rpm
Missing file
    MD5: ac0d75c27ebcd36170f63c60e037f489
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/postgresql/7.0.2-18.2/i386/postgresql-7.0.2-18.2.i386.rpm
Missing file
    MD5: 40f699d6f548c6a90a46f3e85feba1ee
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-devel/7.0.2-18.2/i386/postgresql-devel-7.0.2-18.2.i386.rpm
Missing file
    MD5: ef2087d781505c3c038d8b24bed94540
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-jdbc/7.0.2-18.2/i386/postgresql-jdbc-7.0.2-18.2.i386.rpm
Missing file
    MD5: 4e6ce0a5abff847f96203a1c5b61c8ec
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-odbc/7.0.2-18.2/i386/postgresql-odbc-7.0.2-18.2.i386.rpm
Missing file
    MD5: 3cb5ff6e810db8fdcf249f5b150c5d22
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-perl/7.0.2-18.2/i386/postgresql-perl-7.0.2-18.2.i386.rpm
Missing file
    MD5: fa4a04603929c41c9f27f6db6c13e840
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-python/7.0.2-18.2/i386/postgresql-python-7.0.2-18.2.i386.rpm
Missing file
    MD5: 3c3b41c7138aa0c33817324f91296127
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-server/7.0.2-18.2/i386/postgresql-server-7.0.2-18.2.i386.rpm
Missing file
    MD5: 83e81d641b6fb1d803579d35bd1bcb72
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-tcl/7.0.2-18.2/i386/postgresql-tcl-7.0.2-18.2.i386.rpm
Missing file
    MD5: c6423d569bfed888052c2d8089b6831f
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-tk/7.0.2-18.2/i386/postgresql-tk-7.0.2-18.2.i386.rpm
Missing file
    MD5: 3bd6a70af12569f7664191e6822059cc
 
Red Hat Linux 7.1

SRPMS:
ftp://updates.redhat.com/rhn/repository/NULL/postgresql/7.0.3-9.2/SRPMS/postgresql-7.0.3-9.2.src.rpm
Missing file
    MD5: 92251aabd8b1e84d14e318914f3a5d2d
 
IA-32:
ftp://updates.redhat.com/rhn/repository/NULL/postgresql/7.0.3-9.2/i386/postgresql-7.0.3-9.2.i386.rpm
Missing file
    MD5: dcb353615e8f57e389f48f3e4bf26bc8
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-devel/7.0.3-9.2/i386/postgresql-devel-7.0.3-9.2.i386.rpm
Missing file
    MD5: e73b9ebc33c2d007abbf10cc50db591e
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-jdbc/7.0.3-9.2/i386/postgresql-jdbc-7.0.3-9.2.i386.rpm
Missing file
    MD5: ed79953de3b1af9a27834376456cd4b7
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-odbc/7.0.3-9.2/i386/postgresql-odbc-7.0.3-9.2.i386.rpm
Missing file
    MD5: 3f4ee5dcefb0719a34e89fb036820399
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-perl/7.0.3-9.2/i386/postgresql-perl-7.0.3-9.2.i386.rpm
Missing file
    MD5: 8e4cfea0f12eaed1294d923982581c2e
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-python/7.0.3-9.2/i386/postgresql-python-7.0.3-9.2.i386.rpm
Missing file
    MD5: 612dadb4b08805f2a4b661b4e43be923
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-server/7.0.3-9.2/i386/postgresql-server-7.0.3-9.2.i386.rpm
Missing file
    MD5: 569cf3720c28f1971d6d090ca65da993
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-tcl/7.0.3-9.2/i386/postgresql-tcl-7.0.3-9.2.i386.rpm
Missing file
    MD5: 5f3137d3ce73e129abbbd9f1b4d5541b
ftp://updates.redhat.com/rhn/repository/NULL/postgresql-tk/7.0.3-9.2/i386/postgresql-tk-7.0.3-9.2.i386.rpm
Missing file
    MD5: f358ff4687c07cb82d9264af8ae79a91
 
Red Hat Linux 7.2

SRPMS:
postgresql-7.1.3-4bp.2.src.rpm
File outdated by:  RHSA-2003:313
    MD5: 27ec75858d8f15e4333c78ca816186dc
postgresql-7.1.3-4bp.2.src.rpm
File outdated by:  RHSA-2003:313
    MD5: 27ec75858d8f15e4333c78ca816186dc
 
IA-32:
postgresql-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: 88ca89fd6c48d158604cb19c4721b8fb
postgresql-contrib-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: 673229fe4d65ad583213fbad4199921a
postgresql-devel-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: 901624d92faeadbc56597a465e23313a
postgresql-docs-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: 31008741d14629a520c99db5c3637f99
postgresql-jdbc-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: ada8e8568e3626a2f7355543765e8317
postgresql-libs-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: 96062e762166c1990448caf6c3334881
postgresql-odbc-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: f0b3cf36ce4467c0dc4ca5a1e0b78b29
postgresql-perl-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: 539669074df1afb9d6c7fac0ac51ed3d
postgresql-python-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: fa64bdf8c2b2626fcdedbe1def872b01
postgresql-server-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: 67fe5d278a89c5cffb490d5e803390d2
postgresql-tcl-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: f4ff49541ccf2cee6ab9f5d72c0a3003
postgresql-tk-7.1.3-4bp.2.i386.rpm
File outdated by:  RHSA-2003:313
    MD5: 7682e8c17b6658be3cb102f3ddb06fd9
 
IA-64:
postgresql-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: 04af46f5c9f0cfcd1e4c12c8363bfffd
postgresql-contrib-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: f0b512e2da303b9450fc686d50fe8c9a
postgresql-devel-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: 976a6297da982a1c381a2c2edee2f6fe
postgresql-docs-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: 90609e955c4a271820be3948b45489f7
postgresql-jdbc-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: 988963a98acd91b25b8eb927229af65b
postgresql-libs-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: 667849e8e0cd899451b46bd7fad26b59
postgresql-odbc-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: 0328a3c04aba598d48251ccd2816498a
postgresql-perl-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: aea10ae95c6e2f3c319f16fabc2023eb
postgresql-python-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: 228a329364b0cff9a2517042527907fe
postgresql-server-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: bbe6bee4fdec718afb57e94d7410795a
postgresql-tcl-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: 9ca311fbdbe517743e98d78fd3e90fc6
postgresql-tk-7.1.3-4bp.2.ia64.rpm
File outdated by:  RHSA-2003:313
    MD5: ad36915a19a545d10197976b6753bd28
 

References


Keywords

datetime, lpad, multibyte, PostgreSQL, rpad


These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from:
https://www.redhat.com/security/team/key/#package

The Red Hat security contact is secalert@redhat.com. More contact details at http://www.redhat.com/security/team/contact/