Notifications for a CVE
Stay informed of any changes for a specific CVE.
CVE Descriptions
The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
CVE Informations
Related Weaknesses
| Weakness Name | Source | |
|---|---|---|
| Category : Numeric Errors Weaknesses in this category are related to improper calculation or conversion of numbers. |
Metrics
| Metrics | Score | Severity | CVSS Vector | Source |
|---|---|---|---|---|
| V2 | 6.5 | AV:N/AC:L/Au:S/C:P/I:P/A:P | nvd@nist.gov |
EPSS
EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.
EPSS Score
The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.
EPSS Percentile
The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.
Exploit information
Exploit Database EDB-ID : 33571
Publication date : 2010-01-26 23h00 +00:00
Author : Intevydis
EDB Verified : Yes
source: https://www.securityfocus.com/bid/37973/info
PostgreSQL is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.
Attackers can exploit this issue to execute arbitrary code with elevated privileges or crash the affected application.
PostgreSQL 8.0.23 is vulnerable; other versions may also be affected.
testdb=# select substring(B'101010101010101010101010101010101010
10101010101',33,-15);
Products Mentioned
Configuraton 0
Postgresql>>Postgresql >> Version From (including) 7.4 To (excluding) 7.4.28
- Postgresql>>Postgresql >> Version 7.4 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.1 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.2 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.3 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.4 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.5 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.6 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.7 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.8 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.9 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.10 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.11 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.12 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.13 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.14 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.15 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.16 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.17 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.18 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.19 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.20 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.21 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.22 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.23 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.24 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.25 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.26 (Open CPE detail)
- Postgresql>>Postgresql >> Version 7.4.27 (Open CPE detail)
Postgresql>>Postgresql >> Version From (including) 8.0 To (excluding) 8.0.24
- Postgresql>>Postgresql >> Version 8.0 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.0 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.1 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.2 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.3 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.4 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.5 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.6 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.7 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.8 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.9 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.10 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.11 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.12 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.13 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.14 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.15 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.16 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.17 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.18 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.19 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.20 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.21 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.22 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.0.23 (Open CPE detail)
Postgresql>>Postgresql >> Version From (including) 8.1 To (excluding) 8.1.20
- Postgresql>>Postgresql >> Version 8.1 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.0 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.1 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.2 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.3 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.4 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.5 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.6 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.7 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.8 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.9 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.10 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.11 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.12 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.13 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.14 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.15 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.16 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.17 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.18 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.1.19 (Open CPE detail)
Postgresql>>Postgresql >> Version From (including) 8.2 To (excluding) 8.2.16
- Postgresql>>Postgresql >> Version 8.2 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.0 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.1 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.2 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.3 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.4 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.5 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.6 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.7 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.8 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.9 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.10 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.11 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.12 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.13 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.14 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.2.15 (Open CPE detail)
Postgresql>>Postgresql >> Version From (including) 8.3 To (excluding) 8.3.10
- Postgresql>>Postgresql >> Version 8.3 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.0 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.1 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.2 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.3 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.4 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.5 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.6 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.7 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.8 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.3.9 (Open CPE detail)
Postgresql>>Postgresql >> Version From (including) 8.4 To (excluding) 8.4.3
- Postgresql>>Postgresql >> Version 8.4 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.4.0 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.4.1 (Open CPE detail)
- Postgresql>>Postgresql >> Version 8.4.2 (Open CPE detail)
References
http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commit%3Bh=75dea10196c31d98d98c0bafeeb576ae99c09b12
Tags : x_refsource_CONFIRM
Tags : x_refsource_CONFIRM
http://intevydis.blogspot.com/2010/01/postgresql-8023-bitsubstr-overflow.html
Tags : x_refsource_MISC
Tags : x_refsource_MISC
http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commit%3Bh=b15087cb39ca9e4bde3c8920fcee3741045d2b83
Tags : x_refsource_CONFIRM
Tags : x_refsource_CONFIRM
http://archives.postgresql.org/pgsql-hackers/2010-01/msg00634.php
Tags : mailing-list, x_refsource_MLIST
Tags : mailing-list, x_refsource_MLIST
http://archives.postgresql.org/pgsql-committers/2010-01/msg00125.php
Tags : mailing-list, x_refsource_MLIST
Tags : mailing-list, x_refsource_MLIST
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9720
Tags : vdb-entry, signature, x_refsource_OVAL
Tags : vdb-entry, signature, x_refsource_OVAL
http://www.mandriva.com/security/advisories?name=MDVSA-2010:103
Tags : vendor-advisory, x_refsource_MANDRIVA
Tags : vendor-advisory, x_refsource_MANDRIVA
2025©
tesweb SA
