OpenPKG Security Advisory

Publisher Name:          OpenPKG GmbH
Publisher Home:          http://openpkg.com/

Advisory Id (public):    OpenPKG-SA-2003.048
Advisory Type:           OpenPKG Security Advisory (SA)
Advisory Directory:      http://openpkg.com/go/OpenPKG-SA
Advisory Document:       http://openpkg.com/go/OpenPKG-SA-2003.048
Advisory Published:      2010-02-09 19:11 UTC

Issue Id (internal):     OpenPKG-SI-20031111.01
Issue First Created:     2003-11-11
Issue Last Modified:     2006-11-28
Issue Revision:          07


Subject Name:            PostgreSQL
Subject Summary:         PostgreSQL Database
Subject Home:            http://www.postgresql.org/
Subject Versions:        * <= 7.3.3

Vulnerability Id:        CVE-2003-0901
Vulnerability Scope:     global (not OpenPKG specific)

Attack Feasibility:      run-time
Attack Vector:           remote network
Attack Impact:           arbitrary code execution

Description:
    Notice: This is an update for the OpenPKG security advisory
    OpenPKG-SA-2003.047 [7], released on 30-Oct-2003. Unfortunately, the
    package postgresql-7.3.1-1.2.3 (for OpenPKG 1.2 only) accompanying the
    original security advisory was broken because the created security
    patch was accidentally not included into the resulting source RPM
    package. Thanks to Andreas from Conectiva for discovering this
    packaging bug. The package postgresql-7.3.1-1.2.4 accompanying this
    updated security advisory is now fixed by correctly including the
    necessary security patch.

References:
    [0] http://www.postgresql.org/
    [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-0901
    [2] http://www.openpkg.org/tutorial.html#regular-source
    [3] http://www.openpkg.org/tutorial.html#regular-binary
    [4] ftp://ftp.openpkg.org/release/1.2/UPD/postgresql-7.3.1-1.2.4.src.rpm
    [5] ftp://ftp.openpkg.org/release/1.2/UPD/
    [6] http://www.openpkg.org/security.html#signature
    [7] http://www.openpkg.org/security/OpenPKG-SA-2003.047-postgresql.html


Primary Package Name:    postgresql
Primary Package Home:    http://openpkg.org/go/package/postgresql

Affected Distribution:   Affected Branch:  Affected Package:
OpenPKG Community        1.2-SOLID         postgresql-7.3.1-1.2.3
OpenPKG Community        1.3-SOLID         n/a
OpenPKG Community        CURRENT           postgresql-7.3.3-20030723

Corrected Distribution:  Corrected Branch: Corrected Package:
OpenPKG Community        1.2-SOLID         postgresql-7.3.1-1.2.4
OpenPKG Community        1.3-SOLID         n/a
OpenPKG Community        CURRENT           postgresql-7.3.4-20030725