CVE-2010-0442
PostgreSQL - 'bitsubstr' Buffer Overflow
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
2Exploited in Wild
-Decision
Descriptions
The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
La función bitsubstr en backend/utils/adt/varbit.c en PostgreSQL v8.0.23, v8.1.11 y v8.3.8 permite a usuarios remotos autenticados causar una denegación de servicio (cuelgue del demonio) o tener otro impacto no especificado a través de vectores que implican un entero negativo en el tercer argumento, como lo demuestra una instrucción SELECT que contiene una llamada a la función substring de una cadena de bits, relacionado con un desbordamiento.
Multiple vulnerabilities in the PostgreSQL server and client allow remote attackers to conduct several attacks, including the execution of arbitrary code and denial of service. Versions less than or equal to 9 are affected.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2010-01-27 CVE Reserved
- 2010-02-02 CVE Published
- 2014-05-29 First Exploit
- 2024-08-07 CVE Updated
- 2025-06-03 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-189: Numeric Errors
CAPEC
References (24)
| URL | Tag | Source |
|---|---|---|
| http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567058 | Third Party Advisory | |
| http://intevydis.blogspot.com/2010/01/postgresql-8023-bitsubstr-overflow.html | Third Party Advisory | |
| http://secunia.com/advisories/39566 | Broken Link | |
| http://secunia.com/advisories/39820 | Broken Link | |
| http://secunia.com/advisories/39939 | Broken Link | |
| http://securitytracker.com/id?1023510 | Third Party Advisory | |
| http://www.openwall.com/lists/oss-security/2010/01/27/5 | Mailing List |
|
| https://bugzilla.redhat.com/show_bug.cgi?id=559194 | Issue Tracking | |
| https://exchange.xforce.ibmcloud.com/vulnerabilities/55902 | Third Party Advisory | |
| https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9720 | Signature |
| URL | Date | SRC |
|---|---|---|
| https://www.exploit-db.com/exploits/33571 | 2014-05-29 | |
| http://www.securityfocus.com/bid/37973 | 2024-08-07 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 7.4 < 7.4.28 Search vendor "Postgresql" for product "Postgresql" and version " >= 7.4 < 7.4.28" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 8.0 < 8.0.24 Search vendor "Postgresql" for product "Postgresql" and version " >= 8.0 < 8.0.24" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 8.1 < 8.1.20 Search vendor "Postgresql" for product "Postgresql" and version " >= 8.1 < 8.1.20" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 8.2 < 8.2.16 Search vendor "Postgresql" for product "Postgresql" and version " >= 8.2 < 8.2.16" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 8.3 < 8.3.10 Search vendor "Postgresql" for product "Postgresql" and version " >= 8.3 < 8.3.10" | - |
Affected
| ||||||
| Postgresql Search vendor "Postgresql" | Postgresql Search vendor "Postgresql" for product "Postgresql" | >= 8.4 < 8.4.3 Search vendor "Postgresql" for product "Postgresql" and version " >= 8.4 < 8.4.3" | - |
Affected
| ||||||