CVE-2013-1901
En bref
- Source
- NVD
- EPSS
- EPSS 3.30 % · centile 89 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- redhat
- Statut NVD
- Modified
Description
PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.
Faiblesses (CWE)
Références
- http://www.postgresql.org/docs/current/static/release-9-2-4.html
- http://www.postgresql.org/about/news/1456/
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html
- http://www.mandriva.com/security/advisories?name=MDVSA-2013:142
- http://support.apple.com/kb/HT5892
- http://www.ubuntu.com/usn/USN-1789-1
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html
- http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html
- http://www.postgresql.org/docs/current/static/release-9-1-9.html
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html
- http://www.debian.org/security/2013/dsa-2658
- http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html
- http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html
- http://support.apple.com/kb/HT5880
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:N/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2013-1897
- GCVE · GCVE-0-2013-1901
Avis du CERT-FR
- CERTA-2013-AVI-532 — Multiples vulnérabilités dans Apple OS X Server · cert.ssi.gouv.fr
- CERTA-2013-AVI-529 — Multiples vulnérabilités dans Apple OS X Mountain Lion · cert.ssi.gouv.fr
- CERTA-2013-AVI-221 — Multiples vulnérabilités dans PostgreSQL · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:postgresql:postgresql:9.2:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.2.1:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.2.2:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.2.3:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.1:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.1.5:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.1.6:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.1.7:*:*:*:*:*:*:*cpe:2.3:a:postgresql:postgresql:9.1.8:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:8.04:-:lts:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:10.04:-:lts:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:11.10:*:*:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.04:-:lts:*:*:*:*:*cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| affected n/a |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |