CVE-2009-3230

Severity

65%

Complexity

80%

Confidentiality

106%

The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.

CVSS 2.0 Base Score 6.5. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (AV:N/AC:L/Au:S/C:P/I:P/A:P).

Overview

Type

PostgreSQL

First reported 15 years ago

2009-09-17 10:30:00

Last updated 6 years ago

2018-10-10 19:43:00

Affected Software

PostgreSQL PostgreSQL 7.4

7.4

PostgreSQL PostgreSQL 7.4.1

7.4.1

PostgreSQL PostgreSQL 7.4.2

7.4.2

PostgreSQL PostgreSQL 7.4.3

7.4.3

PostgreSQL PostgreSQL 7.4.4

7.4.4

PostgreSQL PostgreSQL 7.4.5

7.4.5

PostgreSQL PostgreSQL 7.4.6

7.4.6

PostgreSQL PostgreSQL 7.4.7

7.4.7

PostgreSQL PostgreSQL 7.4.8

7.4.8

PostgreSQL PostgreSQL 7.4.9

7.4.9

PostgreSQL PostgreSQL 7.4.10

7.4.10

PostgreSQL PostgreSQL 7.4.11

7.4.11

PostgreSQL PostgreSQL 7.4.12

7.4.12

PostgreSQL PostgreSQL 7.4.13

7.4.13

PostgreSQL PostgreSQL 7.4.14

7.4.14

PostgreSQL PostgreSQL 7.4.15

7.4.15

PostgreSQL PostgreSQL 7.4.16

7.4.16

PostgreSQL PostgreSQL 7.4.17

7.4.17

PostgreSQL PostgreSQL 7.4.18

7.4.18

PostgreSQL PostgreSQL 7.4.19

7.4.19

PostgreSQL PostgreSQL 7.4.20

7.4.20

PostgreSQL PostgreSQL 7.4.21

7.4.21

PostgreSQL PostgreSQL 7.4.22

7.4.22

PostgreSQL PostgreSQL 7.4.23

7.4.23

PostgreSQL PostgreSQL 7.4.24

7.4.24

PostgreSQL PostgreSQL 7.4.25

7.4.25

PostgreSQL 8.0

8.0

PostgreSQL PostgreSQL 8.0.1

8.0.1

PostgreSQL PostgreSQL 8.0.2

8.0.2

PostgreSQL PostgreSQL 8.0.3

8.0.3

PostgreSQL PostgreSQL 8.0.4

8.0.4

PostgreSQL PostgreSQL 8.0.5

8.0.5

PostgreSQL PostgreSQL 8.0.6

8.0.6

PostgreSQL PostgreSQL 8.0.7

8.0.7

PostgreSQL PostgreSQL 8.0.8

8.0.8

PostgreSQL PostgreSQL 8.0.9

8.0.9

PostgreSQL PostgreSQL 8.0.10

8.0.10

PostgreSQL PostgreSQL 8.0.11

8.0.11

PostgreSQL PostgreSQL 8.0.12

8.0.12

PostgreSQL PostgreSQL 8.0.13

8.0.13

PostgreSQL PostgreSQL 8.0.14

8.0.14

PostgreSQL PostgreSQL 8.0.15

8.0.15

PostgreSQL PostgreSQL 8.0.16

8.0.16

PostgreSQL PostgreSQL 8.0.17

8.0.17

PostgreSQL PostgreSQL 8.0.18

8.0.18

PostgreSQL PostgreSQL 8.0.19

8.0.19

PostgreSQL PostgreSQL 8.0.20

8.0.20

PostgreSQL PostgreSQL 8.0.21

8.0.21

PostgreSQL 8.1

8.1

PostgreSQL 8.1.1

8.1.1

PostgreSQL 8.1.2

8.1.2

PostgreSQL 8.1.3

8.1.3

PostgreSQL 8.1.4

8.1.4

PostgreSQL 8.1.5

8.1.5

PostgreSQL 8.1.6

8.1.6

PostgreSQL 8.1.7

8.1.7

PostgreSQL 8.1.8

8.1.8

PostgreSQL 8.1.9

8.1.9

PostgreSQL 8.1.10

8.1.10

PostgreSQL 8.1.11

8.1.11

PostgreSQL 8.1.12

8.1.12

PostgreSQL 8.1.13

8.1.13

PostgreSQL 8.1.14

8.1.14

PostgreSQL 8.1.15

8.1.15

PostgreSQL 8.1.16

8.1.16

PostgreSQL 8.2

8.2

PostgreSQL 8.2.1

8.2.1

PostgreSQL 8.2.2

8.2.2

PostgreSQL 8.2.3

8.2.3

PostgreSQL 8.2.4

8.2.4

PostgreSQL 8.2.5

8.2.5

PostgreSQL 8.2.6

8.2.6

PostgreSQL 8.2.7

8.2.7

PostgreSQL 8.2.8

8.2.8

PostgreSQL 8.2.9

8.2.9

PostgreSQL 8.2.10

8.2.10

PostgreSQL 8.2.11

8.2.11

PostgreSQL 8.2.12

8.2.12

PostgreSQL 8.2.13

8.2.13

PostgreSQL 8.3.1

8.3.1

PostgreSQL 8.3.2

8.3.2

PostgreSQL 8.3.3

8.3.3

PostgreSQL 8.3.4

8.3.4

PostgreSQL 8.3.5

8.3.5

PostgreSQL 8.3.6

8.3.6

PostgreSQL 8.3.7

8.3.7

PostgreSQL 8.4

8.4

References

[pgsql-www] 20090909 Re: Incorrect CVE reference on security page

SUSE-SR:2009:016

SUSE-SR:2009:017

HPSBMU02781

36800

36837

270408

http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012

http://www.postgresql.org/docs/8.3/static/release-8-3-8.html

Vendor Advisory

http://www.postgresql.org/support/security.html

Vendor Advisory

20100307 rPSA-2010-0012-1 postgresql postgresql-contrib postgresql-server

36314

USN-834-1

DSA-1900

ADV-2009-2602

Vendor Advisory

CVE-2009-3230

Severity

What is severity?

Complexity

What is complexity?

Confidentiality

What is confidentiality?

Overview

Type

First reported 15 years ago

Last updated 6 years ago

Affected Software

PostgreSQL PostgreSQL 7.4

PostgreSQL PostgreSQL 7.4.1

PostgreSQL PostgreSQL 7.4.2

PostgreSQL PostgreSQL 7.4.3

PostgreSQL PostgreSQL 7.4.4

PostgreSQL PostgreSQL 7.4.5

PostgreSQL PostgreSQL 7.4.6

PostgreSQL PostgreSQL 7.4.7

PostgreSQL PostgreSQL 7.4.8

PostgreSQL PostgreSQL 7.4.9

PostgreSQL PostgreSQL 7.4.10

PostgreSQL PostgreSQL 7.4.11

PostgreSQL PostgreSQL 7.4.12

PostgreSQL PostgreSQL 7.4.13

PostgreSQL PostgreSQL 7.4.14

PostgreSQL PostgreSQL 7.4.15

PostgreSQL PostgreSQL 7.4.16

PostgreSQL PostgreSQL 7.4.17

PostgreSQL PostgreSQL 7.4.18

PostgreSQL PostgreSQL 7.4.19

PostgreSQL PostgreSQL 7.4.20

PostgreSQL PostgreSQL 7.4.21

PostgreSQL PostgreSQL 7.4.22

PostgreSQL PostgreSQL 7.4.23

PostgreSQL PostgreSQL 7.4.24

PostgreSQL PostgreSQL 7.4.25

PostgreSQL 8.0

PostgreSQL PostgreSQL 8.0.1

PostgreSQL PostgreSQL 8.0.2

PostgreSQL PostgreSQL 8.0.3

PostgreSQL PostgreSQL 8.0.4

PostgreSQL PostgreSQL 8.0.5

PostgreSQL PostgreSQL 8.0.6

PostgreSQL PostgreSQL 8.0.7

PostgreSQL PostgreSQL 8.0.8

PostgreSQL PostgreSQL 8.0.9

PostgreSQL PostgreSQL 8.0.10

PostgreSQL PostgreSQL 8.0.11

PostgreSQL PostgreSQL 8.0.12

PostgreSQL PostgreSQL 8.0.13

PostgreSQL PostgreSQL 8.0.14

PostgreSQL PostgreSQL 8.0.15

PostgreSQL PostgreSQL 8.0.16

PostgreSQL PostgreSQL 8.0.17

PostgreSQL PostgreSQL 8.0.18

PostgreSQL PostgreSQL 8.0.19

PostgreSQL PostgreSQL 8.0.20

PostgreSQL PostgreSQL 8.0.21

PostgreSQL 8.1

PostgreSQL 8.1.1

PostgreSQL 8.1.2

PostgreSQL 8.1.3

PostgreSQL 8.1.4

PostgreSQL 8.1.5

PostgreSQL 8.1.6

PostgreSQL 8.1.7

PostgreSQL 8.1.8

PostgreSQL 8.1.9

PostgreSQL 8.1.10

PostgreSQL 8.1.11

PostgreSQL 8.1.12

PostgreSQL 8.1.13

PostgreSQL 8.1.14

PostgreSQL 8.1.15

PostgreSQL 8.1.16

PostgreSQL 8.2

PostgreSQL 8.2.1

PostgreSQL 8.2.2