-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
                         AUSCERT Security Bulletin

                              ASB-2009.1083.2
           New PostgreSQL versions fix multiple vulnerabilities
                             18 September 2009

===========================================================================

        AusCERT Security Bulletin Summary
        ---------------------------------

Product:              PostgreSQL 7.4.x
                      PostgreSQL 8.0.x
                      PostgreSQL 8.1.x
                      PostgreSQL 8.2.x
                      PostgreSQL 8.3.x
                      PostgreSQL 8.4.x
Operating System:     UNIX variants (UNIX, Linux, OSX)
                      Windows
Impact/Access:        Unauthorised Access  -- Remote/Unauthenticated
                      Increased Privileges -- Existing Account      
                      Denial of Service    -- Existing Account      
Resolution:           Patch/Upgrade
CVE Names:            CVE-2009-3229 CVE-2009-3230 CVE-2009-3231
Member content until: Thursday, October 15 2009

Revision History:     September 18 2009: Updated to include CVEs
                      September 15 2009: Initial Release

OVERVIEW

        New versions of PostgreSQL have been released to fix multiple
        vulnerabilities.


IMPACT

        The vendor has released the following details on the three (3) issues
        resolved in these updates:
        
        o "Authenticated non-superusers can shut down the backend server by
           re-LOAD-ing libraries in $libdir/plugins, if any libraries are
           present there." [1]
        
        o "The fix for issue CVE-2007-6600 (below) failed to include
           protection against misuse of RESET SESSION AUTHORIZATION." [1]
        
        o "If PostgreSQL is configured with LDAP authentication, and your
           LDAP configuration allows anonymous binds, it is possible for a
           user to authenticate themselves with an empty password." [1]


MITIGATION

        The vendor has released versions 7.4.26, 8.0.22, 8.1.18, 8.2.14,
        8.3.8 and 8.4.1 of PostgreSQL to resolve these issues.
        
        Updated versions may be downloaded from the vendor website. [2]
        
        Other vendors which package PostgreSQL are expected to update
        shortly.


REFERENCES

        [1] PostgreSQL: Security Information
            http://www.postgresql.org/support/security.html

        [2] PostgreSQL: Downloads
            http://www.postgresql.org/download/

AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours 
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================
-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iD8DBQFKsv0YNVH5XJJInbgRAkEjAJ0UONRou37SYe6EDza7hinTiXZMhgCbBNIq
iIeBbsyzLSz4th6lgQ5JueU=
=3+i4
-----END PGP SIGNATURE-----