CVE-2009-3231

Опубликовано: 17 сент. 2009

Источник: nvd

CVSS2: 6.8

EPSS Низкий

Описание

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

Ссылки

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
Mailing List
http://marc.info/?l=bugtraq&m=134124585221119&w=2
Mailing List
http://marc.info/?l=bugtraq&m=134124585221119&w=2
Mailing List
http://secunia.com/advisories/36660
Broken Link
Vendor Advisory
http://secunia.com/advisories/36727
Broken Link
Vendor Advisory
http://secunia.com/advisories/36800
Broken Link
http://secunia.com/advisories/36837
Broken Link
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
Broken Link
http://www.postgresql.org/docs/8.3/static/release-8-3-8.html
Release Notes
http://www.postgresql.org/support/security.html
Broken Link
Vendor Advisory
http://www.securityfocus.com/archive/1/509917/100/0/threaded
Broken Link
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/36314
Broken Link
Third Party Advisory
VDB Entry
http://www.ubuntu.com/usn/usn-834-1
Third Party Advisory
http://www.us.debian.org/security/2009/dsa-1900
Broken Link
https://bugzilla.redhat.com/show_bug.cgi?id=522084
Issue Tracking
Patch
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
Mailing List
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
Mailing List

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Версия от 8.2 (включая) до 8.2.14 (исключая)

cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*

Версия от 8.3 (включая) до 8.3.8 (исключая)

Конфигурация 2

Одно из

cpe:2.3:o:opensuse:opensuse:*:*:*:*:*:*:*:*

Версия от 10.3 (включая) до 11.1 (включая)

cpe:2.3:o:suse:linux_enterprise:10.0:sp2:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise:11.0:-:*:*:*:*:*:*

cpe:2.3:o:suse:linux_enterprise_server:9:*:*:*:*:*:*:*

Конфигурация 3

Одно из

cpe:2.3:o:fedoraproject:fedora:10:*:*:*:*:*:*:*

cpe:2.3:o:fedoraproject:fedora:11:*:*:*:*:*:*:*

Конфигурация 4

Одно из

cpe:2.3:o:canonical:ubuntu_linux:6.06:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.04:*:*:*:-:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:8.10:*:*:*:*:*:*:*

cpe:2.3:o:canonical:ubuntu_linux:9.04:*:*:*:*:*:*:*

EPSS

Процентиль: 89%

0.04962

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-287

Связанные уязвимости

CVE-2009-3231

ubuntu

почти 16 лет назад

CVE-2009-3231

redhat

почти 16 лет назад

CVE-2009-3231

debian

почти 16 лет назад

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 befor ...

GHSA-gx42-wp82-42x7

github

около 3 лет назад

EPSS

Процентиль: 89%

0.04962

Низкий

6.8 Medium

CVSS2

Дефекты

CWE-287