Ubuntu 12.04 LTS: USN-1542-1 Critical: PostgreSQL Network Access Issue

ubuntu

August 21, 2012

PostgreSQL could allow unintended access to files over the network when using the XML2 extension.

Summary

PostgreSQL could allow unintended access to files over the network when

using the XML2 extension.

Software Description:

- postgresql-9.1: Object-relational SQL database

- postgresql-8.4: Object-relational SQL database

- postgresql-8.3: Object-relational SQL database

Details:

Peter Eisentraut discovered that the XSLT functionality in the optional

XML2 extension would allow unprivileged database users to both read and

write data with the privileges of the database server. (CVE-2012-3488)

Noah Misch and Tom Lane discovered that the XML functionality in the

optional XML2 extension would allow unprivileged database users to

read data with the privileges of the database server. (CVE-2012-3489)

Topics Covered

security advisory critical Ubuntu PostgreSQL database network access XML2

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.04 LTS:
  postgresql-9.1                  9.1.5-0ubuntu12.04

Ubuntu 11.10:
  postgresql-9.1                  9.1.5-0ubuntu11.10

Ubuntu 11.04:
  postgresql-8.4                  8.4.13-0ubuntu11.04

Ubuntu 10.04 LTS:
  postgresql-8.4                  8.4.13-0ubuntu10.04

Ubuntu 8.04 LTS:
  postgresql-8.3                  8.3.20-0ubuntu8.04

This update uses a new upstream release, which includes additional bug
fixes. Due to upstream security policies, this update removes the ability
of xslt_process() to fetch documents or stylesheets from external URLs.
Please see https://www.postgresql.org/about/news/security-update-2012-08-17-released-1407/ for more information.
In general, a standard system update will make all the necessary changes.