SUSE-SU-2014:0461-1: moderate: Security update for PostgreSQL 9.1

sle-updates at lists.suse.com sle-updates at lists.suse.com
Fri Mar 28 13:04:10 MDT 2014


   SUSE Security Update: Security update for PostgreSQL 9.1
______________________________________________________________________________

Announcement ID:    SUSE-SU-2014:0461-1
Rating:             moderate
References:         #864845 #864846 #864847 #864850 #864851 #864852 
                    #864853 
Cross-References:   CVE-2014-0060 CVE-2014-0061 CVE-2014-0062
                    CVE-2014-0063 CVE-2014-0064 CVE-2014-0065
                    CVE-2014-0066
Affected Products:
                    SUSE Linux Enterprise Software Development Kit 11 SP3
                    SUSE Linux Enterprise Server 11 SP3 for VMware
                    SUSE Linux Enterprise Server 11 SP3
                    SUSE Linux Enterprise Desktop 11 SP3
______________________________________________________________________________

   An update that fixes 7 vulnerabilities is now available. It
   includes one version update.

Description:


   The PostgreSQL database server was updated to version
   9.1.12 to fix various  security issues:

   *

   Granting a role without ADMIN OPTION is supposed to
   prevent the grantee from adding or removing members from
   the granted role, but this restriction was easily bypassed
   by doing SET ROLE first. The security impact is mostly that
   a role member can revoke the access of others, contrary to
   the wishes of his grantor. Unapproved role member additions
   are a lesser concern, since an uncooperative role member
   could provide most of his rights to others anyway by
   creating views or SECURITY DEFINER functions.
   (CVE-2014-0060)

   *

   The primary role of PL validator functions is to be
   called implicitly during CREATE FUNCTION, but they are also
   normal SQL functions that a user can call explicitly.
   Calling a validator on a function actually written in some
   other language was not checked for and could be exploited
   for privilege-escalation purposes. The fix involves adding
   a call to a privilege-checking function in each validator
   function. Non-core procedural languages will also need to
   make this change to their own validator functions, if any.
   (CVE-2014-0061)

   *

   If the name lookups come to different conclusions due
   to concurrent activity, we might perform some parts of the
   DDL on a different table than other parts. At least in the
   case of CREATE INDEX, this can be used to cause the
   permissions checks to be performed against a different
   table than the index creation, allowing for a privilege
   escalation attack. (CVE-2014-0062)

   *

   The MAXDATELEN constant was too small for the longest
   possible value of type interval, allowing a buffer overrun
   in interval_out(). Although the datetime input functions
   were more careful about avoiding buffer overrun, the limit
   was short enough to cause them to reject some valid inputs,
   such as input containing a very long timezone name. The
   ecpg library contained these vulnerabilities along with
   some of its own. (CVE-2014-0063)

   *

   Several functions, mostly type input functions,
   calculated an allocation size without checking for
   overflow. If overflow did occur, a too-small buffer would
   be allocated and then written past. (CVE-2014-0064)

   *

   Use strlcpy() and related functions to provide a
   clear guarantee that fixed-size buffers are not overrun.
   Unlike the preceding items, it is unclear whether these
   cases really represent live issues, since in most cases
   there appear to be previous constraints on the size of the
   input string. Nonetheless it seems prudent to silence all
   Coverity warnings of this type. (CVE-2014-0065)

   *

   There are relatively few scenarios in which crypt()
   could return NULL, but contrib/chkpass would crash if it
   did. One practical case in which this could be an issue is
   if libc is configured to refuse to execute unapproved
   hashing algorithms (e.g., "FIPS mode"). (CVE-2014-0066)

   *

   Since the temporary server started by make check uses
   "trust" authentication, another user on the same machine
   could connect to it as database superuser, and then
   potentially exploit the privileges of the operating-system
   user who started the tests. A future release will probably
   incorporate changes in the testing procedure to prevent
   this risk, but some public discussion is needed first. So
   for the moment, just warn people against using make check
   when there are untrusted users on the same machine.
   (CVE-2014-0067)

   The complete list of bugs and more information can be found
   at:
   http://www.postgresql.org/docs/9.1/static/release-9-1-12.htm
   l
   <http://www.postgresql.org/docs/9.1/static/release-9-1-12.ht
   ml>

   Security Issues references:

   * CVE-2014-0060
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0060
   >
   * CVE-2014-0061
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0061
   >
   * CVE-2014-0062
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0062
   >
   * CVE-2014-0063
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0063
   >
   * CVE-2014-0064
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0064
   >
   * CVE-2014-0065
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0065
   >
   * CVE-2014-0066
   <http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0066
   >


Patch Instructions:

   To install this SUSE Security Update use YaST online_update.
   Alternatively you can run the command listed for your product:

   - SUSE Linux Enterprise Software Development Kit 11 SP3:

      zypper in -t patch sdksp3-libecpg6-8970

   - SUSE Linux Enterprise Server 11 SP3 for VMware:

      zypper in -t patch slessp3-libecpg6-8970

   - SUSE Linux Enterprise Server 11 SP3:

      zypper in -t patch slessp3-libecpg6-8970

   - SUSE Linux Enterprise Desktop 11 SP3:

      zypper in -t patch sledsp3-libecpg6-8970

   To bring your system up-to-date, use "zypper patch".


Package List:

   - SUSE Linux Enterprise Software Development Kit 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.1.12]:

      postgresql91-devel-9.1.12-0.3.1

   - SUSE Linux Enterprise Server 11 SP3 for VMware (i586 x86_64) [New Version: 9.1.12]:

      libecpg6-9.1.12-0.3.1
      libpq5-9.1.12-0.3.1
      postgresql91-9.1.12-0.3.1
      postgresql91-contrib-9.1.12-0.3.1
      postgresql91-docs-9.1.12-0.3.1
      postgresql91-server-9.1.12-0.3.1

   - SUSE Linux Enterprise Server 11 SP3 for VMware (x86_64) [New Version: 9.1.12]:

      libpq5-32bit-9.1.12-0.3.1

   - SUSE Linux Enterprise Server 11 SP3 (i586 ia64 ppc64 s390x x86_64) [New Version: 9.1.12]:

      libecpg6-9.1.12-0.3.1
      libpq5-9.1.12-0.3.1
      postgresql91-9.1.12-0.3.1
      postgresql91-contrib-9.1.12-0.3.1
      postgresql91-docs-9.1.12-0.3.1
      postgresql91-server-9.1.12-0.3.1

   - SUSE Linux Enterprise Server 11 SP3 (ppc64 s390x x86_64) [New Version: 9.1.12]:

      libpq5-32bit-9.1.12-0.3.1

   - SUSE Linux Enterprise Desktop 11 SP3 (i586 x86_64) [New Version: 9.1.12]:

      libecpg6-9.1.12-0.3.1
      libpq5-9.1.12-0.3.1
      postgresql91-9.1.12-0.3.1
      postgresql91-docs-9.1.12-0.3.1

   - SUSE Linux Enterprise Desktop 11 SP3 (x86_64) [New Version: 9.1.12]:

      libpq5-32bit-9.1.12-0.3.1


References:

   http://support.novell.com/security/cve/CVE-2014-0060.html
   http://support.novell.com/security/cve/CVE-2014-0061.html
   http://support.novell.com/security/cve/CVE-2014-0062.html
   http://support.novell.com/security/cve/CVE-2014-0063.html
   http://support.novell.com/security/cve/CVE-2014-0064.html
   http://support.novell.com/security/cve/CVE-2014-0065.html
   http://support.novell.com/security/cve/CVE-2014-0066.html
   https://bugzilla.novell.com/864845
   https://bugzilla.novell.com/864846
   https://bugzilla.novell.com/864847
   https://bugzilla.novell.com/864850
   https://bugzilla.novell.com/864851
   https://bugzilla.novell.com/864852
   https://bugzilla.novell.com/864853
   http://download.suse.com/patch/finder/?keywords=e9bf55125376b211617f7b7eb984b251



More information about the sle-updates mailing list