CVE-2007-6600
PostgreSQL privilege escalation
Severity Score
6.5
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.
PostgreSQL 8.2 anterior a 8.2.6, 8.1 anterior a 8.1.11, 8.0 anterior a 8.0.15, 7.4 anterior a 7.4.19, y 7.3 anterior a 7.3.21 utiliza privilegios de super usuario en lugar de los privilegios del propietario de la tabla para las operaciones (1) VACUUM y (2) ANALYZE en funciones de índice, y soporta (3) SET ROLE y (4) SET SESSION AUTHORIZATION en funciones de índice, lo cual permite a usuarios remotos autenticados obtener privilegios.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2007-12-31 CVE Reserved
- 2008-01-09 CVE Published
- 2024-08-07 CVE Updated
- 2024-11-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-264: Permissions, Privileges, and Access Controls
CAPEC
References (40)
| URL | Tag | Source |
|---|---|---|
| http://securitytracker.com/id?1019157 | Vdb Entry | |
| http://www.securityfocus.com/archive/1/485864/100/0/threaded | Mailing List | |
| http://www.securityfocus.com/archive/1/486407/100/0/threaded | Mailing List | |
| http://www.vupen.com/english/advisories/2008/0061 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2008/0109 | Vdb Entry | |
| http://www.vupen.com/english/advisories/2008/1071/references | Vdb Entry | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/39496 | Vdb Entry | |
| https://issues.rpath.com/browse/RPL-1768 | X_refsource_confirm | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10493 | Signature |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://www.postgresql.org/about/news.905 | 2018-10-15 | |
| http://www.securityfocus.com/bid/27163 | 2018-10-15 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3 Search vendor "Postgresql" for product "Postgresql" and version "7.3" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.1 Search vendor "Postgresql" for product "Postgresql" and version "7.3.1" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.2 Search vendor "Postgresql" for product "Postgresql" and version "7.3.2" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.3 Search vendor "Postgresql" for product "Postgresql" and version "7.3.3" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.4 Search vendor "Postgresql" for product "Postgresql" and version "7.3.4" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.5 Search vendor "Postgresql" for product "Postgresql" and version "7.3.5" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.6 Search vendor "Postgresql" for product "Postgresql" and version "7.3.6" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.7 Search vendor "Postgresql" for product "Postgresql" and version "7.3.7" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.8 Search vendor "Postgresql" for product "Postgresql" and version "7.3.8" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.9 Search vendor "Postgresql" for product "Postgresql" and version "7.3.9" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.10 Search vendor "Postgresql" for product "Postgresql" and version "7.3.10" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.11 Search vendor "Postgresql" for product "Postgresql" and version "7.3.11" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.12 Search vendor "Postgresql" for product "Postgresql" and version "7.3.12" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.13 Search vendor "Postgresql" for product "Postgresql" and version "7.3.13" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.14 Search vendor "Postgresql" for product "Postgresql" and version "7.3.14" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.15 Search vendor "Postgresql" for product "Postgresql" and version "7.3.15" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.16 Search vendor "Postgresql" for product "Postgresql" and version "7.3.16" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.17 Search vendor "Postgresql" for product "Postgresql" and version "7.3.17" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.18 Search vendor "Postgresql" for product "Postgresql" and version "7.3.18" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.3.19 Search vendor "Postgresql" for product "Postgresql" and version "7.3.19" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4 Search vendor "Postgresql" for product "Postgresql" and version "7.4" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.1 Search vendor "Postgresql" for product "Postgresql" and version "7.4.1" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.2 Search vendor "Postgresql" for product "Postgresql" and version "7.4.2" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.3 Search vendor "Postgresql" for product "Postgresql" and version "7.4.3" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.4 Search vendor "Postgresql" for product "Postgresql" and version "7.4.4" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.5 Search vendor "Postgresql" for product "Postgresql" and version "7.4.5" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.6 Search vendor "Postgresql" for product "Postgresql" and version "7.4.6" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.7 Search vendor "Postgresql" for product "Postgresql" and version "7.4.7" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.8 Search vendor "Postgresql" for product "Postgresql" and version "7.4.8" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.9 Search vendor "Postgresql" for product "Postgresql" and version "7.4.9" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.10 Search vendor "Postgresql" for product "Postgresql" and version "7.4.10" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.11 Search vendor "Postgresql" for product "Postgresql" and version "7.4.11" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.12 Search vendor "Postgresql" for product "Postgresql" and version "7.4.12" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.13 Search vendor "Postgresql" for product "Postgresql" and version "7.4.13" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.14 Search vendor "Postgresql" for product "Postgresql" and version "7.4.14" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.16 Search vendor "Postgresql" for product "Postgresql" and version "7.4.16" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.17 Search vendor "Postgresql" for product "Postgresql" and version "7.4.17" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.18 Search vendor "Postgresql" for product "Postgresql" and version "7.4.18" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0 Search vendor "Postgresql" for product "Postgresql" and version "8.0" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.0 Search vendor "Postgresql" for product "Postgresql" and version "8.0.0" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.1 Search vendor "Postgresql" for product "Postgresql" and version "8.0.1" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.2 Search vendor "Postgresql" for product "Postgresql" and version "8.0.2" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.3 Search vendor "Postgresql" for product "Postgresql" and version "8.0.3" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.4 Search vendor "Postgresql" for product "Postgresql" and version "8.0.4" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.5 Search vendor "Postgresql" for product "Postgresql" and version "8.0.5" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.6 Search vendor "Postgresql" for product "Postgresql" and version "8.0.6" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.7 Search vendor "Postgresql" for product "Postgresql" and version "8.0.7" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.8 Search vendor "Postgresql" for product "Postgresql" and version "8.0.8" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.9 Search vendor "Postgresql" for product "Postgresql" and version "8.0.9" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.10 Search vendor "Postgresql" for product "Postgresql" and version "8.0.10" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.11 Search vendor "Postgresql" for product "Postgresql" and version "8.0.11" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.12 Search vendor "Postgresql" for product "Postgresql" and version "8.0.12" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.13 Search vendor "Postgresql" for product "Postgresql" and version "8.0.13" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.14 Search vendor "Postgresql" for product "Postgresql" and version "8.0.14" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.1 Search vendor "Postgresql" for product "Postgresql" and version "8.1.1" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.2 Search vendor "Postgresql" for product "Postgresql" and version "8.1.2" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.3 Search vendor "Postgresql" for product "Postgresql" and version "8.1.3" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.4 Search vendor "Postgresql" for product "Postgresql" and version "8.1.4" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.5 Search vendor "Postgresql" for product "Postgresql" and version "8.1.5" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.6 Search vendor "Postgresql" for product "Postgresql" and version "8.1.6" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.7 Search vendor "Postgresql" for product "Postgresql" and version "8.1.7" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.8 Search vendor "Postgresql" for product "Postgresql" and version "8.1.8" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.9 Search vendor "Postgresql" for product "Postgresql" and version "8.1.9" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.10 Search vendor "Postgresql" for product "Postgresql" and version "8.1.10" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2 Search vendor "Postgresql" for product "Postgresql" and version "8.2" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.1 Search vendor "Postgresql" for product "Postgresql" and version "8.2.1" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.2 Search vendor "Postgresql" for product "Postgresql" and version "8.2.2" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.3 Search vendor "Postgresql" for product "Postgresql" and version "8.2.3" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.4 Search vendor "Postgresql" for product "Postgresql" and version "8.2.4" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.5 Search vendor "Postgresql" for product "Postgresql" and version "8.2.5" | - |
Affected
| ||||||