CVE-2007-3280
The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 25.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access.
- CVSS 2.0
- 9.0 HIGHAV:N/AC:L/Au:S/C:C/I:C/A:C
- EPSS
- 25.49% probability · 98th percentile
- CISA KEV
- Not listed
- Affected
- postgresql/postgresql
- Source
- cve@mitre.org
References
- http://osvdb.org/40901
- http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:188
- http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf
- http://www.securityfocus.com/archive/1/471541/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35145
- http://osvdb.org/40901
- http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt
- http://www.mandriva.com/security/advisories?name=MDKSA-2007:188
- http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf
- http://www.securityfocus.com/archive/1/471541/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/35145
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.