Ubuntu 12.10: 1789-1 Critical: PostgreSQL Remote Threat Fixes

ubuntu

April 4, 2013

Several security issues were fixed in PostgreSQL.

Summary

Several security issues were fixed in PostgreSQL.

Software Description:

- postgresql-9.1: Object-relational SQL database

- postgresql-8.4: Object-relational SQL database

- postgresql-8.3: Object-relational SQL database

Details:

Mitsumasa Kondo and Kyotaro Horiguchi discovered that PostgreSQL

incorrectly handled certain connection requests containing database names

starting with a dash. A remote attacker could use this flaw to damage or

destroy files within a server's data directory. This issue only applied to

Ubuntu 11.10, Ubuntu 12.04 LTS, and Ubuntu 12.10. (CVE-2013-1899)

Marko Kreen discovered that PostgreSQL incorrectly generated random

numbers. An authenticated attacker could use this flaw to possibly guess

another database user's random numbers. (CVE-2013-1900)

Noah Misch discovered that PostgreSQL incorrectly handled certain privilege

checks. An unprivileged attacker could use this flaw to possibly interfere

with in-progress backups. This issue onl...

Read the Full Advisory

Topics Covered

security advisory critical fix remote threat ubuntu postgresql

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 12.10:
  postgresql-9.1                  9.1.9-0ubuntu12.10

Ubuntu 12.04 LTS:
  postgresql-9.1                  9.1.9-0ubuntu12.04

Ubuntu 11.10:
  postgresql-9.1                  9.1.9-0ubuntu11.10

Ubuntu 10.04 LTS:
  postgresql-8.4                  8.4.17-0ubuntu10.04

Ubuntu 8.04 LTS:
  postgresql-8.3                  8.3.23-0ubuntu8.04.1

This update uses a new upstream release, which includes additional bug
fixes. In general, a standard system update will make all the necessary
changes.