// For flags

CVE-2007-6601

PostgreSQL privilege escalation via dblink

Severity Score

7.2
*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

0
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2007-3278.

El módulo DBLink en PostgreSQL 8.2 anterior a 8.2.6, 8.1 anterior a 8.1.11, 8.0 anterior a 8.0.15, 7.4 anterior a 7.4.19, y 7.3 anterior a 7.3.21, cuando locales de confianza o identidades de autenticación son utilizadas, permite a atacantes remotos ganar privlegios a través de vectores no especificados. NOTA: este asunto existe a causa de un parche incompleto para CVE-2007-3278.

*Credits: N/A
CVSS Scores
Attack Vector
Local
Attack Complexity
Low
Authentication
None
Confidentiality
Complete
Integrity
Complete
Availability
Complete
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2007-12-31 CVE Reserved
  • 2008-01-09 CVE Published
  • 2024-08-07 CVE Updated
  • 2024-10-05 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
  • ---------- First Exploit
CWE
  • CWE-287: Improper Authentication
CAPEC
References (37)
URL Tag Source
http://secunia.com/advisories/28376 Not Applicable
http://secunia.com/advisories/28437 Not Applicable
http://secunia.com/advisories/28438 Not Applicable
http://secunia.com/advisories/28445 Not Applicable
http://secunia.com/advisories/28454 Not Applicable
http://secunia.com/advisories/28455 Not Applicable
http://secunia.com/advisories/28464 Not Applicable
http://secunia.com/advisories/28477 Not Applicable
http://secunia.com/advisories/28479 Not Applicable
http://secunia.com/advisories/28679 Not Applicable
http://secunia.com/advisories/28698 Not Applicable
http://secunia.com/advisories/29638 Not Applicable
http://securitytracker.com/id?1019157 Broken Link
http://www.postgresql.org/about/news.905 Broken Link
http://www.securityfocus.com/archive/1/485864/100/0/threaded Mailing List
http://www.securityfocus.com/archive/1/486407/100/0/threaded Mailing List
https://exchange.xforce.ibmcloud.com/vulnerabilities/39500 Third Party Advisory
https://issues.rpath.com/browse/RPL-1768 Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11127 Broken Link
URL Date SRC
URL Date SRC
http://www.securityfocus.com/bid/27163 2023-01-18
URL Date SRC
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154 2023-01-18
http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html 2023-01-18
http://secunia.com/advisories/28359 2023-01-18
http://security.gentoo.org/glsa/glsa-200801-15.xml 2023-01-18
http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1 2023-01-18
http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1 2023-01-18
http://www.debian.org/security/2008/dsa-1460 2023-01-18
http://www.debian.org/security/2008/dsa-1463 2023-01-18
http://www.mandriva.com/security/advisories?name=MDVSA-2008:004 2023-01-18
http://www.redhat.com/support/errata/RHSA-2008-0038.html 2023-01-18
http://www.redhat.com/support/errata/RHSA-2008-0039.html 2023-01-18
http://www.redhat.com/support/errata/RHSA-2008-0040.html 2023-01-18
https://usn.ubuntu.com/568-1 2023-01-18
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00397.html 2023-01-18
https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00469.html 2023-01-18
https://access.redhat.com/security/cve/CVE-2007-6601 2008-02-01
https://bugzilla.redhat.com/show_bug.cgi?id=427128 2008-02-01
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Postgresql
Search vendor "Postgresql"
 Postgresql
Search vendor "Postgresql" for product "Postgresql"
 >= 7.3.0 < 7.3.21
Search vendor "Postgresql" for product "Postgresql" and version " >= 7.3.0 < 7.3.21"
-
Affected
Postgresql
Search vendor "Postgresql"
 Postgresql
Search vendor "Postgresql" for product "Postgresql"
 >= 7.4.0 < 7.4.19
Search vendor "Postgresql" for product "Postgresql" and version " >= 7.4.0 < 7.4.19"
-
Affected
Postgresql
Search vendor "Postgresql"
 Postgresql
Search vendor "Postgresql" for product "Postgresql"
 >= 8.0.0 < 8.0.15
Search vendor "Postgresql" for product "Postgresql" and version " >= 8.0.0 < 8.0.15"
-
Affected
Postgresql
Search vendor "Postgresql"
 Postgresql
Search vendor "Postgresql" for product "Postgresql"
 >= 8.1.0 < 8.1.11
Search vendor "Postgresql" for product "Postgresql" and version " >= 8.1.0 < 8.1.11"
-
Affected
Postgresql
Search vendor "Postgresql"
 Postgresql
Search vendor "Postgresql" for product "Postgresql"
 >= 8.2.0 < 8.2.6
Search vendor "Postgresql" for product "Postgresql" and version " >= 8.2.0 < 8.2.6"
-
Affected
Postgresql
Search vendor "Postgresql"
 Postgresql
Search vendor "Postgresql" for product "Postgresql"
 8.2
Search vendor "Postgresql" for product "Postgresql" and version "8.2"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 3.1
Search vendor "Debian" for product "Debian Linux" and version "3.1"
-
Affected
Debian
Search vendor "Debian"
 Debian Linux
Search vendor "Debian" for product "Debian Linux"
 4.0
Search vendor "Debian" for product "Debian Linux" and version "4.0"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 7
Search vendor "Fedoraproject" for product "Fedora" and version "7"
-
Affected
Fedoraproject
Search vendor "Fedoraproject"
 Fedora
Search vendor "Fedoraproject" for product "Fedora"
 8
Search vendor "Fedoraproject" for product "Fedora" and version "8"
-
Affected