CVE-2009-3230
Last modified
CVE-2009-3230 is a vulnerability of currently unknown severity. The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.. EPSS estimates a 2.83% chance of exploitation in the next 30 days.
Description
The core server component in PostgreSQL 8.4 before 8.4.1, 8.3 before 8.3.8, 8.2 before 8.2.14, 8.1 before 8.1.18, 8.0 before 8.0.22, and 7.4 before 7.4.26 does not use the appropriate privileges for the (1) RESET ROLE and (2) RESET SESSION AUTHORIZATION operations, which allows remote authenticated users to gain privileges. NOTE: this is due to an incomplete fix for CVE-2007-6600.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Postgresql | Postgresql | 7.4 |
| Postgresql | Postgresql | 7.4.1 |
| Postgresql | Postgresql | 7.4.2 |
| Postgresql | Postgresql | 7.4.3 |
| Postgresql | Postgresql | 7.4.4 |
| Postgresql | Postgresql | 7.4.5 |
| Postgresql | Postgresql | 7.4.6 |
| Postgresql | Postgresql | 7.4.7 |
| Postgresql | Postgresql | 7.4.8 |
| Postgresql | Postgresql | 7.4.9 |
| Postgresql | Postgresql | 7.4.10 |
| Postgresql | Postgresql | 7.4.11 |
| Postgresql | Postgresql | 7.4.12 |
| Postgresql | Postgresql | 7.4.13 |
| Postgresql | Postgresql | 7.4.14 |
| Postgresql | Postgresql | 7.4.15 |
| Postgresql | Postgresql | 7.4.16 |
| Postgresql | Postgresql | 7.4.17 |
| Postgresql | Postgresql | 7.4.18 |
| Postgresql | Postgresql | 7.4.19 |
| Postgresql | Postgresql | 7.4.20 |
| Postgresql | Postgresql | 7.4.21 |
| Postgresql | Postgresql | 7.4.22 |
| Postgresql | Postgresql | 7.4.23 |
| Postgresql | Postgresql | 7.4.24 |
| Postgresql | Postgresql | 7.4.25 |
| Postgresql | Postgresql | 8.0 |
| Postgresql | Postgresql | 8.0.1 |
| Postgresql | Postgresql | 8.0.2 |
| Postgresql | Postgresql | 8.0.3 |
| Postgresql | Postgresql | 8.0.4 |
| Postgresql | Postgresql | 8.0.5 |
| Postgresql | Postgresql | 8.0.6 |
| Postgresql | Postgresql | 8.0.7 |
| Postgresql | Postgresql | 8.0.8 |
| Postgresql | Postgresql | 8.0.9 |
| Postgresql | Postgresql | 8.0.10 |
| Postgresql | Postgresql | 8.0.11 |
| Postgresql | Postgresql | 8.0.12 |
| Postgresql | Postgresql | 8.0.13 |
| Postgresql | Postgresql | 8.0.14 |
| Postgresql | Postgresql | 8.0.15 |
| Postgresql | Postgresql | 8.0.16 |
| Postgresql | Postgresql | 8.0.17 |
| Postgresql | Postgresql | 8.0.18 |
| Postgresql | Postgresql | 8.0.19 |
| Postgresql | Postgresql | 8.0.20 |
| Postgresql | Postgresql | 8.0.21 |
| Postgresql | Postgresql | 8.1 |
| Postgresql | Postgresql | 8.1.1 |
Showing 50 of 87 affected configurations. See NVD for the full list.
References
- http://secunia.com/advisories/36660Vendor Advisory
- http://secunia.com/advisories/36695Vendor Advisory
- http://secunia.com/advisories/36727Vendor Advisory
- http://www.postgresql.org/docs/8.3/static/release-8-3-8.htmlVendor Advisory
- http://www.postgresql.org/support/security.htmlVendor Advisory
- http://www.vupen.com/english/advisories/2009/2602Vendor Advisory
- http://secunia.com/advisories/36660Vendor Advisory
- http://secunia.com/advisories/36695Vendor Advisory
- http://secunia.com/advisories/36727Vendor Advisory
- http://www.postgresql.org/docs/8.3/static/release-8-3-8.htmlVendor Advisory
- http://www.postgresql.org/support/security.htmlVendor Advisory
- http://www.vupen.com/english/advisories/2009/2602Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-3230?
How severe is CVE-2009-3230?
How do I fix CVE-2009-3230?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-3224SQL injection vulnerability in index.php in Super Mod System…
- CVE-2009-3225Multiple cross-site scripting (XSS) vulnerabilities in Almon…
- CVE-2009-3226SQL injection vulnerability in index.php in AlmondSoft Almon…
- CVE-2009-3227Cross-site scripting (XSS) vulnerability in index.php in Alm…
- CVE-2009-3228The tc_fill_tclass function in net/sched/sch_api.c in the tc…
- CVE-2009-3229The core server component in PostgreSQL 8.4 before 8.4.1, 8.…
- CVE-2009-3231The core server component in PostgreSQL 8.3 before 8.3.8 and…
- CVE-2009-3232pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and…
- CVE-2009-3233changetrack 4.3 allows local users to execute arbitrary comm…
- CVE-2009-3234Buffer overflow in the perf_copy_attr function in kernel/per…
- CVE-2009-3235Multiple stack-based buffer overflows in the Sieve plugin in…
- CVE-2009-3236The form library in Horde Application Framework 3.2 before 3…
Are you affected by CVE-2009-3230?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST