CVE-2007-6600
PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3)…
Does this matter?
Lower severity and a low EPSS score (3.12%). Track it; it rarely justifies an emergency change on its own.
Description
PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.
- CVSS 2.0
- 6.5 MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
- EPSS
- 3.12% probability · 87th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- postgresql/postgresql
- Source
- cve@mitre.org
References
- http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154
- http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html
- http://secunia.com/advisories/28359Vendor Advisory
- http://secunia.com/advisories/28376Vendor Advisory
- http://secunia.com/advisories/28437Vendor Advisory
- http://secunia.com/advisories/28438Vendor Advisory
- http://secunia.com/advisories/28445Vendor Advisory
- http://secunia.com/advisories/28454Vendor Advisory
- http://secunia.com/advisories/28455Vendor Advisory
- http://secunia.com/advisories/28464Vendor Advisory
- http://secunia.com/advisories/28477Vendor Advisory
- http://secunia.com/advisories/28479Vendor Advisory
- http://secunia.com/advisories/28679Vendor Advisory
- http://secunia.com/advisories/28698Vendor Advisory
- http://secunia.com/advisories/29638Vendor Advisory
- http://security.gentoo.org/glsa/glsa-200801-15.xml
- http://securitytracker.com/id?1019157
- http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1
- http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1
- http://www.debian.org/security/2008/dsa-1460
- http://www.debian.org/security/2008/dsa-1463
- http://www.mandriva.com/security/advisories?name=MDVSA-2008:004
- http://www.postgresql.org/about/news.905Patch, Vendor Advisory
- http://www.redhat.com/support/errata/RHSA-2008-0038.html
- http://www.redhat.com/support/errata/RHSA-2008-0039.html
- http://www.redhat.com/support/errata/RHSA-2008-0040.html
- http://www.securityfocus.com/archive/1/485864/100/0/threaded
- http://www.securityfocus.com/archive/1/486407/100/0/threaded
- http://www.securityfocus.com/bid/27163Patch
- http://www.vupen.com/english/advisories/2008/0061
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.