製品・ソフトウェアに関する情報

JVN脆弱性詳細

PostgreSQL におけるサービス運用妨害 (サーバクラッシュ) の脆弱性

Title	PostgreSQL におけるサービス運用妨害 (サーバクラッシュ) の脆弱性
Summary	PostgreSQL は、backend/utils/adt/enum.c 内の enum_recv 関数について適切に宣言しないため、間違った引数で呼び出され、サービス運用妨害 (サーバクラッシュ) 状態となる、または重要なプロセスメモリを読まれる脆弱性が存在します。
Possible impacts	リモート認証されたユーザにより、配列のインデックスエラーおよび領域外メモリの読み込み (out-of-bounds read) を誘発する巧妙に細工された SQL コマンドを介して、サービス運用妨害 (サーバクラッシュ) 状態となる、または重要なプロセスメモリを読まれる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	Feb. 7, 2013, midnight
Registration Date	Feb. 15, 2013, 4:48 p.m.
Last Update	Feb. 18, 2014, 3:26 p.m.

CVSS2.0 : 警告
Score	6.8
Vector	AV:N/AC:L/Au:S/C:N/I:N/A:C

Affected System

レッドハット

Red Hat Enterprise Linux (v. 5 server)

Red Hat Enterprise Linux Desktop (v. 5 client)

Red Hat Enterprise Linux Desktop (v. 6)

Red Hat Enterprise Linux HPC Node (v. 6)

Red Hat Enterprise Linux Server (v. 6)

Red Hat Enterprise Linux Server AUS (v. 6.4)

Red Hat Enterprise Linux Server EUS (v. 6.4.z)

Red Hat Enterprise Linux Workstation (v. 6)

RHEL Desktop Workstation (v. 5 client)

PostgreSQL.org

PostgreSQL 8.3.23 未満の 8.3.x

PostgreSQL 8.4.16 未満の 8.4.x

PostgreSQL 9.0.12 未満の 9.0.x

PostgreSQL 9.1.8 未満の 9.1.x

PostgreSQL 9.2.3 未満の 9.2.x

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2013-0255	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0255
National Vulnerability Database (NVD)
2	CVE-2013-0255	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-0255
SECURITY BLOG
3	CVE-2013-0255 Array Index error vulnerability in PostgreSQL	https://blogs.oracle.com/sunsecurity/entry/cve_2013_0255_array_index

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
Debian Security Advisory
1	DSA-2630	http://www.debian.org/security/2013/dsa-2630
Fedora Update Notification
2	FEDORA-2013-2123	http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098586.html
opensuse-updates
3	openSUSE-SU-2013:0318	http://lists.opensuse.org/opensuse-updates/2013-02/msg00059.html
4	openSUSE-SU-2013:0319	http://lists.opensuse.org/opensuse-updates/2013-02/msg00060.html
PostgreSQL Release Notes
5	Release 8.3.23	http://www.postgresql.org/docs/8.3/static/release-8-3-23.html
6	Release 8.4.16	http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
7	Release 9.0.12	http://www.postgresql.org/docs/9.0/static/release-9-0-12.html
8	Release 9.1.8	http://www.postgresql.org/docs/9.1/static/release-9-1-8.html
9	Release 9.2.3	http://www.postgresql.org/docs/9.2/static/release-9-2-3.html
Red Hat Bugzilla
10	Bug 907892	https://bugzilla.redhat.com/show_bug.cgi?id=907892
Red Hat Security Advisory
11	RHSA-2013:1475	http://rhn.redhat.com/errata/RHSA-2013-1475.html
Ubuntu Security Notice
12	USN-1717-1	http://www.ubuntu.com/usn/USN-1717-1/

Change Log

No	Changed Details	Date of change
0	[2013年02月15日] 掲載 [2013年03月12日] ベンダ情報：Debian (DSA-2630) を追加ベンダ情報：openSUSE (openSUSE-SU-2013:0319) を追加ベンダ情報：openSUSE (openSUSE-SU-2013:0318) を追加 [2013年04月05日] ベンダ情報：オラクル (CVE-2013-0255 Array Index error vulnerability in PostgreSQL) を追加 [2014年02月18日] 影響を受けるシステム：レッドハット (RHSA-2013:1475) の情報を追加ベンダ情報：レッドハット (RHSA-2013:1475) を追加	Feb. 17, 2018, 10:37 a.m.

NVD Vulnerability Information

CVE-2013-0255

Summary	PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in backend/utils/adt/enum.c, which causes it to be invoked with incorrect arguments and allows remote authenticated users to cause a denial of service (server crash) or read sensitive process memory via a crafted SQL command, which triggers an array index error and an out-of-bounds read.
Publication Date	Feb. 13, 2013, 10:55 a.m.
Registration Date	Jan. 26, 2021, 3:33 p.m.
Last Update	Nov. 21, 2024, 10:47 a.m.

Affected software configurations

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:8.3.6:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.17:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.21:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.3:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.2:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.12:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.18:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.20:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.14:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.1:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.5:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.8:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.7:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.10:::::::*
cpe:2.3:a:postgresql:postgresql:8.3:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.16:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.4:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.11:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.9:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.13:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.15:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.22:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.19:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:8.4.8:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.4:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.1:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.9:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.3:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.10:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.11:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.6:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.15:::::::*
cpe:2.3:a:postgresql:postgresql:8.4:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.12:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.14:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.5:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.7:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.2:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.13:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:9.0.11:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.10:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.0:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.8:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:9.1.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.1:::::::*

Configuration5		or higher	or less	more than	less than

Related information, measures and tools

No	URL	タグ
1	http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098586.html
2	http://lists.fedoraproject.org/pipermail/package-announce/2013-February/098586.html
3	http://lists.opensuse.org/opensuse-updates/2013-02/msg00059.html
4	http://lists.opensuse.org/opensuse-updates/2013-02/msg00059.html
5	http://lists.opensuse.org/opensuse-updates/2013-02/msg00060.html
6	http://lists.opensuse.org/opensuse-updates/2013-02/msg00060.html
7	http://osvdb.org/89935
8	http://osvdb.org/89935
9	http://rhn.redhat.com/errata/RHSA-2013-1475.html
10	http://rhn.redhat.com/errata/RHSA-2013-1475.html
11	http://secunia.com/advisories/51923	Vendor Advisory
12	http://secunia.com/advisories/51923	Vendor Advisory
13	http://secunia.com/advisories/52819
14	http://secunia.com/advisories/52819
15	http://securitytracker.com/id?1028092
16	http://securitytracker.com/id?1028092
17	http://www.debian.org/security/2013/dsa-2630
18	http://www.debian.org/security/2013/dsa-2630
19	http://www.mandriva.com/security/advisories?name=MDVSA-2013:142
20	http://www.mandriva.com/security/advisories?name=MDVSA-2013:142
21	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
22	http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html
23	http://www.postgresql.org/docs/8.3/static/release-8-3-23.html
24	http://www.postgresql.org/docs/8.3/static/release-8-3-23.html
25	http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
26	http://www.postgresql.org/docs/8.4/static/release-8-4-16.html
27	http://www.postgresql.org/docs/9.0/static/release-9-0-12.html
28	http://www.postgresql.org/docs/9.0/static/release-9-0-12.html
29	http://www.postgresql.org/docs/9.1/static/release-9-1-8.html
30	http://www.postgresql.org/docs/9.1/static/release-9-1-8.html
31	http://www.postgresql.org/docs/9.2/static/release-9-2-3.html
32	http://www.postgresql.org/docs/9.2/static/release-9-2-3.html
33	http://www.securityfocus.com/bid/57844
34	http://www.securityfocus.com/bid/57844
35	http://www.ubuntu.com/usn/USN-1717-1
36	http://www.ubuntu.com/usn/USN-1717-1
37	https://blogs.oracle.com/sunsecurity/entry/cve_2013_0255_array_index
38	https://blogs.oracle.com/sunsecurity/entry/cve_2013_0255_array_index
39	https://bugzilla.redhat.com/show_bug.cgi?id=907892
40	https://bugzilla.redhat.com/show_bug.cgi?id=907892
41	https://exchange.xforce.ibmcloud.com/vulnerabilities/81917
42	https://exchange.xforce.ibmcloud.com/vulnerabilities/81917

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

Configuration1	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:8.3.6:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.17:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.21:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.3:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.2:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.12:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.18:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.20:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.14:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.1:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.5:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.8:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.7:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.10:::::::*
cpe:2.3:a:postgresql:postgresql:8.3:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.16:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.4:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.11:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.9:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.13:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.15:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.22:::::::*
cpe:2.3:a:postgresql:postgresql:8.3.19:::::::*

Configuration2	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:8.4.8:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.4:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.1:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.9:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.3:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.10:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.11:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.6:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.15:::::::*
cpe:2.3:a:postgresql:postgresql:8.4:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.12:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.14:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.5:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.7:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.2:::::::*
cpe:2.3:a:postgresql:postgresql:8.4.13:::::::*

Configuration3	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:9.0.11:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.10:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.9:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.0:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.0.8:::::::*

Configuration4	or higher	or less	more than	less than
cpe:2.3:a:postgresql:postgresql:9.1.4:::::::*
cpe:2.3:a:postgresql:postgresql:9.1:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.5:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.2:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.6:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.7:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.3:::::::*
cpe:2.3:a:postgresql:postgresql:9.1.1:::::::*