CVE-2012-0868 Detail

CVE-2012-0868

CVE Descriptions

CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to execute arbitrary SQL commands via a crafted file containing object names with newlines, which are inserted into an SQL script that is used when the database is restored.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-89	Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	6.8		AV:N/AC:M/Au:N/C:P/I:P/A:P	nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Products Mentioned

Configuraton 0

Postgresql>>Postgresql >> Version 8.3

Postgresql>>Postgresql >> Version 8.3 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.1

Postgresql>>Postgresql >> Version 8.3.1 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.2

Postgresql>>Postgresql >> Version 8.3.2 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.3

Postgresql>>Postgresql >> Version 8.3.3 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.4

Postgresql>>Postgresql >> Version 8.3.4 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.5

Postgresql>>Postgresql >> Version 8.3.5 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.6

Postgresql>>Postgresql >> Version 8.3.6 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.7

Postgresql>>Postgresql >> Version 8.3.7 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.8

Postgresql>>Postgresql >> Version 8.3.8 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.9

Postgresql>>Postgresql >> Version 8.3.9 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.10

Postgresql>>Postgresql >> Version 8.3.10 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.11

Postgresql>>Postgresql >> Version 8.3.11 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.12

Postgresql>>Postgresql >> Version 8.3.12 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.13

Postgresql>>Postgresql >> Version 8.3.13 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.14

Postgresql>>Postgresql >> Version 8.3.14 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.15

Postgresql>>Postgresql >> Version 8.3.15 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.16

Postgresql>>Postgresql >> Version 8.3.16 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.3.17

Postgresql>>Postgresql >> Version 8.3.17 (Open CPE detail)

Configuraton 0

Postgresql>>Postgresql >> Version 8.4

Postgresql>>Postgresql >> Version 8.4 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.1

Postgresql>>Postgresql >> Version 8.4.1 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.2

Postgresql>>Postgresql >> Version 8.4.2 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.3

Postgresql>>Postgresql >> Version 8.4.3 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.4

Postgresql>>Postgresql >> Version 8.4.4 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.5

Postgresql>>Postgresql >> Version 8.4.5 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.6

Postgresql>>Postgresql >> Version 8.4.6 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.7

Postgresql>>Postgresql >> Version 8.4.7 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.8

Postgresql>>Postgresql >> Version 8.4.8 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.9

Postgresql>>Postgresql >> Version 8.4.9 (Open CPE detail)

Postgresql>>Postgresql >> Version 8.4.10

Postgresql>>Postgresql >> Version 8.4.10 (Open CPE detail)

Configuraton 0

Postgresql>>Postgresql >> Version 9.0

Postgresql>>Postgresql >> Version 9.0 (Open CPE detail)

Postgresql>>Postgresql >> Version 9.0.1

Postgresql>>Postgresql >> Version 9.0.1 (Open CPE detail)

Postgresql>>Postgresql >> Version 9.0.2

Postgresql>>Postgresql >> Version 9.0.2 (Open CPE detail)

Postgresql>>Postgresql >> Version 9.0.3

Postgresql>>Postgresql >> Version 9.0.3 (Open CPE detail)

Postgresql>>Postgresql >> Version 9.0.4

Postgresql>>Postgresql >> Version 9.0.4 (Open CPE detail)

Postgresql>>Postgresql >> Version 9.0.5

Postgresql>>Postgresql >> Version 9.0.5 (Open CPE detail)

Postgresql>>Postgresql >> Version 9.0.6

Postgresql>>Postgresql >> Version 9.0.6 (Open CPE detail)

Configuraton 0

Postgresql>>Postgresql >> Version 9.1

Postgresql>>Postgresql >> Version 9.1 (Open CPE detail)

Postgresql>>Postgresql >> Version 9.1.1

Postgresql>>Postgresql >> Version 9.1.1 (Open CPE detail)

Postgresql>>Postgresql >> Version 9.1.2

Postgresql>>Postgresql >> Version 9.1.2 (Open CPE detail)

References

http://www.postgresql.org/about/news/1377/
Tags : x_refsource_CONFIRM

http://www.mandriva.com/security/advisories?name=MDVSA-2012:027
Tags : vendor-advisory, x_refsource_MANDRIVA

http://secunia.com/advisories/49273
Tags : third-party-advisory, x_refsource_SECUNIA

http://rhn.redhat.com/errata/RHSA-2012-0678.html
Tags : vendor-advisory, x_refsource_REDHAT

http://www.mandriva.com/security/advisories?name=MDVSA-2012:026
Tags : vendor-advisory, x_refsource_MANDRIVA

http://www.postgresql.org/docs/9.0/static/release-9-0-7.html
Tags : x_refsource_CONFIRM

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705
Tags : x_refsource_CONFIRM

http://www.postgresql.org/docs/8.4/static/release-8-4-11.html
Tags : x_refsource_CONFIRM

http://www.debian.org/security/2012/dsa-2418
Tags : vendor-advisory, x_refsource_DEBIAN

http://www.postgresql.org/docs/8.3/static/release-8-3-18.html
Tags : x_refsource_CONFIRM

http://secunia.com/advisories/49272
Tags : third-party-advisory, x_refsource_SECUNIA

http://www.postgresql.org/docs/9.1/static/release-9-1-3.html
Tags : x_refsource_CONFIRM

http://rhn.redhat.com/errata/RHSA-2012-0677.html
Tags : vendor-advisory, x_refsource_REDHAT

http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html
Tags : vendor-advisory, x_refsource_SUSE

CVE-2012-0868 : Detail

CVE-2012-0868

CVE Descriptions

CVE Informations

Related Weaknesses

Metrics

EPSS

EPSS Score

EPSS Percentile

Products Mentioned

Configuraton 0

Configuraton 0

Configuraton 0

Configuraton 0

References