OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2003.047
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2003.047
Advisory Published:      2009-07-05 04:05 UTC

Issue Id (internal):     OpenPKG-SI-20031030.01
Issue First Created:     2003-10-30
Issue Last Modified:     2006-11-28
Issue Revision:          07


Subject Name:            PostgreSQL
Subject Summary:         PostgreSQL Database
Subject Home:            http://www.postgresql.org/
Subject Versions:        * <= 7.3.3

Vulnerability Id:        CVE-2003-0901
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           arbitrary code execution

Description:
    Two bugs leading to a buffer overflow in the PostgreSQL [0] RDBMS,
    versions 7.2.x and 7.3.x prior to 7.3.4, were discovered. The
    vulnerability exists in the PostgreSQL abstract data type (ADT) to
    ASCII conversion functions.
    
    It has been conjectured that excessive data passed to the involved
    to_ascii_xxx() functions may overrun the bounds of an insufficient
    buffer reserved in heap memory, resulting in the corruption of heap
    based memory management structures that are adjacent to it. It is
    currently believed that under the correct circumstances an attacker
    may use this to execute arbitrary instructions in the context of the
    PostgreSQL server.

References:
    [0] http://www.postgresql.org/
    [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0901
    [2] http://www.openpkg.org/tutorial.html#regular-source
    [3] http://www.openpkg.org/tutorial.html#regular-binary
    [4] ftp://ftp.openpkg.org/release/1.2/UPD/postgresql-7.3.1-1.2.3.src.rpm
    [5] ftp://ftp.openpkg.org/release/1.2/UPD/
    [6] http://www.openpkg.org/security.html#signature


Primary Package Name:    postgresql
Primary Package Home:    http://openpkg.org/go/package/postgresql

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        1.2-SOLID         postgresql-7.3.1-1.2.2
OpenPKG Community        1.3-SOLID         n/a
OpenPKG Community        CURRENT           postgresql-7.3.3-20030723

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        1.2-SOLID         postgresql-7.3.1-1.2.3
OpenPKG Community        1.3-SOLID         n/a
OpenPKG Community        CURRENT           postgresql-7.3.4-20030725