Arch Linux ASA-201608-14 Critical: PostgreSQL Remote Execution Risks

Arch Linux Security Advisory ASA-201608-14
=========================================
Severity: Critical
Date    : 2016-08-14
CVE-ID  : CVE-2016-5423 CVE-2016-5424
Package : postgresql
Type    : multiple issues
Remote  : Yes
Link    : https://wiki.archlinux.org/title/CVE

Summary
======
The package postgresql before version 9.5.4-1 is vulnerable to multiple
issues.

Resolution
=========
Upgrade to 9.5.4-1.

# pacman -Syu "postgresql>=9.5.4-1"

The problems have been fixed upstream in version 9.5.4.

Workaround
=========
None.

Description
==========
- CVE-2016-5423 (arbitrary code execution)

It was discovered that certain SQL statements containing CASE/WHEN
commands could crash the PostgreSQL server, or disclose a few bytes of
server memory, potentially leading to arbitrary code execution.

- CVE-2016-5424 (privilege escalation)

It was found that PostgreSQL client programs mishandle database and role
names containing newlines, carriage returns, double quotes, or
backslashes. By crafting such an object name, roles with the CREATEDB or
CREATEROLE option could escalate their privileges to superuser when a
superuser next executes maintenance with a vulnerable program.
Vulnerable programs include pg_dumpall, pg_upgrade, vacuumdb, reindexdb,
and clusterdb.

Impact
=====
A remote authenticated attacker can execute arbitrary code on the
affected server by executing a crafted SQL statement.
A local authenticated attacker can gain superuser privileges by creating
an object with a crafted name.

References
=========
https://https://www.postgresql.org/about/news/pg_tileserv-for-postgresqlpostgis-2016/
https://access.redhat.com/security/cve/CVE-2016-5423
https://access.redhat.com/security/cve/CVE-2016-5424