CVE-2009-4136
postgresql: SQL privilege escalation via modifications to session-local state
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
PostgreSQL v7.4.x anteriores a v7.4.27, v8.0.x anteriores a v8.0.23, v8.1.x anteriores a v8.1.19, v8.2.x anteriores a v8.2.15, v8.3.x anteriores a v8.3.9, y v8.4.x anteriores a v8.4.2 no gestiona adecuadamente el estado de la sesión local durante la ejecución de una función de indexado por parte de un superusuario de base de datos, lo que permite a usuarios remotos autenticados conseguir ganar privilegios a través de una tabla con las funcione de indexado manipuladas, como se demuestra en las funciones (1) search_path o (2) una declaración, un asunto relacionado con CVE-2007-6600 y CVE-2009-3230.
NULL Bytes in SSL Certificates can be used to falsify client or server authentication. This only affects users who have SSL enabled, perform certificate name validation or client certificate authentication, and where the Certificate Authority (CA) has been tricked into issuing invalid certificates. The use of a CA that can be trusted to always issue valid certificates is recommended to ensure you are not vulnerable to this issue. Privilege escalation via changing session state in an index function. This closes a corner case related to vulnerabilities and CVE-2007-6600. Packages for 2008.0 are being provided due to extended support for Corporate products. This update provides a solution to these vulnerabilities.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2009-12-01 CVE Reserved
- 2009-12-15 CVE Published
- 2024-08-07 CVE Updated
- 2025-06-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
CAPEC
References (27)
URL | Tag | Source |
---|---|---|
http://osvdb.org/61039 | Vdb Entry | |
http://secunia.com/advisories/37663 | Third Party Advisory | |
http://secunia.com/advisories/39820 | Third Party Advisory | |
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012 | X_refsource_confirm | |
http://www.securityfocus.com/archive/1/509917/100/0/threaded | Mailing List | |
http://www.securityfocus.com/bid/37333 | Vdb Entry | |
http://www.securitytracker.com/id?1023326 | Vdb Entry | |
http://www.vupen.com/english/advisories/2009/3519 | Vdb Entry | |
http://www.vupen.com/english/advisories/2010/1197 | Vdb Entry | |
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9358 | Signature |
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.1 Search vendor "Postgresql" for product "Postgresql" and version "7.4.1" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.2 Search vendor "Postgresql" for product "Postgresql" and version "7.4.2" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.3 Search vendor "Postgresql" for product "Postgresql" and version "7.4.3" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.4 Search vendor "Postgresql" for product "Postgresql" and version "7.4.4" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.5 Search vendor "Postgresql" for product "Postgresql" and version "7.4.5" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.6 Search vendor "Postgresql" for product "Postgresql" and version "7.4.6" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.7 Search vendor "Postgresql" for product "Postgresql" and version "7.4.7" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.8 Search vendor "Postgresql" for product "Postgresql" and version "7.4.8" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.9 Search vendor "Postgresql" for product "Postgresql" and version "7.4.9" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.10 Search vendor "Postgresql" for product "Postgresql" and version "7.4.10" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.11 Search vendor "Postgresql" for product "Postgresql" and version "7.4.11" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.12 Search vendor "Postgresql" for product "Postgresql" and version "7.4.12" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.13 Search vendor "Postgresql" for product "Postgresql" and version "7.4.13" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.14 Search vendor "Postgresql" for product "Postgresql" and version "7.4.14" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.15 Search vendor "Postgresql" for product "Postgresql" and version "7.4.15" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.16 Search vendor "Postgresql" for product "Postgresql" and version "7.4.16" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.17 Search vendor "Postgresql" for product "Postgresql" and version "7.4.17" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.18 Search vendor "Postgresql" for product "Postgresql" and version "7.4.18" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.19 Search vendor "Postgresql" for product "Postgresql" and version "7.4.19" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.20 Search vendor "Postgresql" for product "Postgresql" and version "7.4.20" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.21 Search vendor "Postgresql" for product "Postgresql" and version "7.4.21" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.22 Search vendor "Postgresql" for product "Postgresql" and version "7.4.22" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.23 Search vendor "Postgresql" for product "Postgresql" and version "7.4.23" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.24 Search vendor "Postgresql" for product "Postgresql" and version "7.4.24" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.25 Search vendor "Postgresql" for product "Postgresql" and version "7.4.25" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 7.4.26 Search vendor "Postgresql" for product "Postgresql" and version "7.4.26" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.0 Search vendor "Postgresql" for product "Postgresql" and version "8.0.0" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.1 Search vendor "Postgresql" for product "Postgresql" and version "8.0.1" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.2 Search vendor "Postgresql" for product "Postgresql" and version "8.0.2" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.3 Search vendor "Postgresql" for product "Postgresql" and version "8.0.3" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.4 Search vendor "Postgresql" for product "Postgresql" and version "8.0.4" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.5 Search vendor "Postgresql" for product "Postgresql" and version "8.0.5" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.6 Search vendor "Postgresql" for product "Postgresql" and version "8.0.6" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.7 Search vendor "Postgresql" for product "Postgresql" and version "8.0.7" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.8 Search vendor "Postgresql" for product "Postgresql" and version "8.0.8" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.9 Search vendor "Postgresql" for product "Postgresql" and version "8.0.9" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.10 Search vendor "Postgresql" for product "Postgresql" and version "8.0.10" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.11 Search vendor "Postgresql" for product "Postgresql" and version "8.0.11" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.12 Search vendor "Postgresql" for product "Postgresql" and version "8.0.12" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.13 Search vendor "Postgresql" for product "Postgresql" and version "8.0.13" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.14 Search vendor "Postgresql" for product "Postgresql" and version "8.0.14" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.15 Search vendor "Postgresql" for product "Postgresql" and version "8.0.15" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.16 Search vendor "Postgresql" for product "Postgresql" and version "8.0.16" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.17 Search vendor "Postgresql" for product "Postgresql" and version "8.0.17" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.18 Search vendor "Postgresql" for product "Postgresql" and version "8.0.18" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.19 Search vendor "Postgresql" for product "Postgresql" and version "8.0.19" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.20 Search vendor "Postgresql" for product "Postgresql" and version "8.0.20" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.21 Search vendor "Postgresql" for product "Postgresql" and version "8.0.21" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.0.22 Search vendor "Postgresql" for product "Postgresql" and version "8.0.22" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.0 Search vendor "Postgresql" for product "Postgresql" and version "8.1.0" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.1 Search vendor "Postgresql" for product "Postgresql" and version "8.1.1" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.2 Search vendor "Postgresql" for product "Postgresql" and version "8.1.2" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.3 Search vendor "Postgresql" for product "Postgresql" and version "8.1.3" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.4 Search vendor "Postgresql" for product "Postgresql" and version "8.1.4" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.5 Search vendor "Postgresql" for product "Postgresql" and version "8.1.5" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.6 Search vendor "Postgresql" for product "Postgresql" and version "8.1.6" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.7 Search vendor "Postgresql" for product "Postgresql" and version "8.1.7" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.8 Search vendor "Postgresql" for product "Postgresql" and version "8.1.8" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.9 Search vendor "Postgresql" for product "Postgresql" and version "8.1.9" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.10 Search vendor "Postgresql" for product "Postgresql" and version "8.1.10" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.11 Search vendor "Postgresql" for product "Postgresql" and version "8.1.11" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.12 Search vendor "Postgresql" for product "Postgresql" and version "8.1.12" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.13 Search vendor "Postgresql" for product "Postgresql" and version "8.1.13" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.14 Search vendor "Postgresql" for product "Postgresql" and version "8.1.14" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.15 Search vendor "Postgresql" for product "Postgresql" and version "8.1.15" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.16 Search vendor "Postgresql" for product "Postgresql" and version "8.1.16" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.17 Search vendor "Postgresql" for product "Postgresql" and version "8.1.17" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.1.18 Search vendor "Postgresql" for product "Postgresql" and version "8.1.18" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2 Search vendor "Postgresql" for product "Postgresql" and version "8.2" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.1 Search vendor "Postgresql" for product "Postgresql" and version "8.2.1" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.2 Search vendor "Postgresql" for product "Postgresql" and version "8.2.2" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.3 Search vendor "Postgresql" for product "Postgresql" and version "8.2.3" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.4 Search vendor "Postgresql" for product "Postgresql" and version "8.2.4" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.5 Search vendor "Postgresql" for product "Postgresql" and version "8.2.5" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.6 Search vendor "Postgresql" for product "Postgresql" and version "8.2.6" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.7 Search vendor "Postgresql" for product "Postgresql" and version "8.2.7" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.8 Search vendor "Postgresql" for product "Postgresql" and version "8.2.8" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.9 Search vendor "Postgresql" for product "Postgresql" and version "8.2.9" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.10 Search vendor "Postgresql" for product "Postgresql" and version "8.2.10" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.11 Search vendor "Postgresql" for product "Postgresql" and version "8.2.11" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.12 Search vendor "Postgresql" for product "Postgresql" and version "8.2.12" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.13 Search vendor "Postgresql" for product "Postgresql" and version "8.2.13" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.2.14 Search vendor "Postgresql" for product "Postgresql" and version "8.2.14" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.3.1 Search vendor "Postgresql" for product "Postgresql" and version "8.3.1" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.3.2 Search vendor "Postgresql" for product "Postgresql" and version "8.3.2" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.3.3 Search vendor "Postgresql" for product "Postgresql" and version "8.3.3" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.3.4 Search vendor "Postgresql" for product "Postgresql" and version "8.3.4" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.3.5 Search vendor "Postgresql" for product "Postgresql" and version "8.3.5" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.3.6 Search vendor "Postgresql" for product "Postgresql" and version "8.3.6" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.3.7 Search vendor "Postgresql" for product "Postgresql" and version "8.3.7" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.3.8 Search vendor "Postgresql" for product "Postgresql" and version "8.3.8" | - |
Affected
| ||||||
Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | 8.4.1 Search vendor "Postgresql" for product "Postgresql" and version "8.4.1" | - |
Affected
|