Security World: [SECURITY] [DSA-1964-1] New PostgreSQL packages fix several vulnerabilities

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

- ------------------------------------------------------------------------
Debian Security Advisory DSA-1964-1 security@debian.org
http://www.debian.org/security/ Florian Weimer
December 31, 2009 http://www.debian.org/security/faq
- ------------------------------------------------------------------------

Package : postgresql-7.4, postgresql-8.1, postgresql-8.3
Vulnerability : several
Problem type : remote
Debian-specific: no
CVE Id(s) : CVE-2009-4034 CVE-2009-4136

Several vulnerabilities have been discovered in PostgreSQL, a database
server. The Common Vulnerabilities and Exposures project identifies
the following problems:

It was discovered that PostgreSQL did not properly verify the Common
Name attribute in X.509 certificates, enabling attackers to bypass the
(optional) TLS protection on client-server connections, by relying on
a certificate from a trusted CA which contains an embedded NUL byte in
the Common Name (CVE-2009-4034).

Authenticated database users could elevate their privileges by
creating specially-crafted index functions (CVE-2009-4136).

The following table shows fixed source package versions for the
respective distributions.

oldstable/etch stable/lenny testing/unstable
postgresql-7.4 7.4.27-0etch1
postgresql-8.1 8.1.19-0etch1
postgresql-8.3 8.3.9-0lenny1 8.3.9-1
postgresql-8.4 8.4.2-1

In addition to these security fixes, the updates contain reliability
improvements and fix other defects.

We recommend that you upgrade your PostgreSQL packages.

Upgrade instructions
- --------------------

wget url
will fetch the file for you
dpkg -i file.deb
will install the referenced file.

If you are using the apt-get package manager, use the line for
sources.list as given below:

apt-get update
will update the internal database
apt-get upgrade
will install corrected packages

You may use an automated update by adding the resources from the
footer to the proper configuration.

Debian GNU/Linux 4.0 alias etch
- -------------------------------

Source archives:

http://security.debian.org/pool/updates/main/p/postgresql-8.1/postgresql-8.1_8.1.19-0etch1.diff.gz
Size/MD5 checksum: 40781 7e87c7dba806e8f17527ecd44f3b21ad
http://security.debian.org/pool/updates/main/p/postgresql-8.1/postgresql-8.1_8.1.19.orig.tar.gz
Size/MD5 checksum: 11535709 64185bcc279f0787017d89596ad519a0
http://security.debian.org/pool/updates/main/p/postgresql-7.4/postgresql-7.4_7.4.27.orig.tar.gz
Size/MD5 checksum: 10060890 ec501383ae38f79397c50ecf62e4eda5
http://security.debian.org/pool/updates/main/p/postgresql-8.1/postgresql-8.1_8.1.19-0etch1.dsc
Size/MD5 checksum: 1179 9a2edb5a2dfe632748f7ad720c7c9ea2
http://security.debian.org/pool/updates/main/p/postgresql-7.4/postgresql-7.4_7.4.27-0etch1.diff.gz
Size/MD5 checksum: 36672 7d7f09f39c682a1d618e3c1e82615410
http://security.debian.org/pool/updates/main/p/postgresql-7.4/postgresql-7.4_7.4.27-0etch1.dsc
Size/MD5 checksum: 1134 b7487381adfbf4dbbf4972c66cbe6c85

Architecture independent packages:

http://security.debian.org/pool/updates/main/p/postgresql-7.4/postgresql-server-dev-7.4_7.4.27-0etch1_all.deb
Size/MD5 checksum: 531632 739cdd7ee12a7ebd4b8becceba7ff010
http://security.debian.org/pool/updates/main/p/postgresql-8.1/postgresql-doc-8.1_8.1.19-0etch1_all.deb
Size/MD5 checksum: 1521982 29989a9668481d64a22906e8a8cb39e6
http://security.debian.org/pool/updates/main/p/postgresql-7.4/postgresql-doc-7.4_7.4.27-0etch1_all.deb
Size/MD5 checksum: 1193124 542a60916e16ac48b7b6651602c44891

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

Debian GNU/Linux 5.0 alias lenny
- --------------------------------

Source archives:

http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.9-0lenny1.dsc
Size/MD5 checksum: 1665 1ef1bcb1f66dbf3aaedaa438ca96c6ae
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.9.orig.tar.gz
Size/MD5 checksum: 13850244 05088ab3b924a326914572eb77db541b
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-8.3_8.3.9-0lenny1.diff.gz
Size/MD5 checksum: 45140 0ab48c65a1c42e677e63c49a3198b65b

Architecture independent packages:

http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-client_8.3.9-0lenny1_all.deb
Size/MD5 checksum: 247808 063f66f5cde6932b9ce8565ec618b259
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql_8.3.9-0lenny1_all.deb
Size/MD5 checksum: 247844 bb2a8b43ddcfd84d36534748fa282867
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-doc_8.3.9-0lenny1_all.deb
Size/MD5 checksum: 247646 92f36e64dd46940994d3d6679c5a370e
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-contrib_8.3.9-0lenny1_all.deb
Size/MD5 checksum: 247706 fcef243b109aadb0afe5e24af72fadfd
http://security.debian.org/pool/updates/main/p/postgresql-8.3/postgresql-doc-8.3_8.3.9-0lenny1_all.deb
Size/MD5 checksum: 2155508 b0c862dd5a120683369859f098d58968

alpha architecture (DEC Alpha)

amd64 architecture (AMD x86_64 (AMD64))

arm architecture (ARM)

armel architecture (ARM EABI)

hppa architecture (HP PA RISC)

i386 architecture (Intel ia32)

ia64 architecture (Intel ia64)

mips architecture (MIPS (Big Endian))

mipsel architecture (MIPS (Little Endian))

powerpc architecture (PowerPC)

s390 architecture (IBM S/390)

sparc architecture (Sun SPARC/UltraSPARC)

These files will probably be moved into the stable distribution on
its next update.

- ---------------------------------------------------------------------------------
For apt-get: deb http://security.debian.org/ stable/updates main
For dpkg-ftp: ftp://security.debian.org/debian-security dists/stable/updates/main
Mailing list: debian-security-announce@lists.debian.org
Package info: `apt-cache show <pkg>' and http://packages.debian.org/<pkg>
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.9 (GNU/Linux)

iQEcBAEBAgAGBQJLPNLLAAoJEL97/wQC1SS+N3YIAJh1GzzzK1O68j+iuGH0LHvD
5b40d9qSDvM913aJsIAysyD9hAIBNjzD9L7EOlbBWEu5zff9j2w2K6jh40G06lQl
7jKIlAISlfUOfZM8y1FXqjfBd+127/4fR4RZ/uHcv20SDzI9f6QsZRZMJ0FP6CQf
V8mOs+nppEaeO5nN6/Ewsy4W1IhFvyubpbNWIFL44sq0MGoOBeIMlLt2LqLUGg8U
MDVBOcQsYBp1/C7VgMMBwKJo8m+dqleY+m5bqZ9lvLLdAly6YuMuXCuqci8e/5g7
m0s3RqsoEXWx09eTBWyhF3tzO2K4D6K8WuWQKvRUVZuwGHH93K2DSUnCpBYOkMs=
=U4U/
-----END PGP SIGNATURE-----

--
To UNSUBSCRIBE, email to debian-security-announce-REQUEST@lists.debian.org
with a subject of "unsubscribe". Trouble? Contact listmaster@lists.debian.org

Security World

Thursday, December 31, 2009

[SECURITY] [DSA-1964-1] New PostgreSQL packages fix several vulnerabilities

No comments:

Post a Comment