CVE-2009-3231

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

• CWE-287

• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.htmlMailing List
• http://marc.info/?l=bugtraq&m=134124585221119&w=2Mailing List
• http://secunia.com/advisories/36660Broken Link, Vendor Advisory
• http://secunia.com/advisories/36727Broken Link, Vendor Advisory
• http://secunia.com/advisories/36800Broken Link
• http://secunia.com/advisories/36837Broken Link
• http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012Broken Link
• http://www.postgresql.org/docs/8.3/static/release-8-3-8.htmlRelease Notes
• http://www.postgresql.org/support/security.htmlBroken Link, Vendor Advisory
• http://www.securityfocus.com/archive/1/509917/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/36314Broken Link, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/usn-834-1Third Party Advisory
• http://www.us.debian.org/security/2009/dsa-1900Broken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=522084Issue Tracking, Patch
• https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.htmlMailing List
• https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.htmlMailing List
• http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.htmlMailing List
• http://marc.info/?l=bugtraq&m=134124585221119&w=2Mailing List
• http://secunia.com/advisories/36660Broken Link, Vendor Advisory
• http://secunia.com/advisories/36727Broken Link, Vendor Advisory
• http://secunia.com/advisories/36800Broken Link
• http://secunia.com/advisories/36837Broken Link
• http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012Broken Link
• http://www.postgresql.org/docs/8.3/static/release-8-3-8.htmlRelease Notes
• http://www.postgresql.org/support/security.htmlBroken Link, Vendor Advisory
• http://www.securityfocus.com/archive/1/509917/100/0/threadedBroken Link, Third Party Advisory, VDB Entry
• http://www.securityfocus.com/bid/36314Broken Link, Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/usn-834-1Third Party Advisory
• http://www.us.debian.org/security/2009/dsa-1900Broken Link
• https://bugzilla.redhat.com/show_bug.cgi?id=522084Issue Tracking, Patch
• https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.htmlMailing List
• https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.htmlMailing List

Published

Sep 17, 2009

Last Modified

Jun 16, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2009-3225Multiple cross-site scripting (XSS) vulnerabilities in Almon…
• CVE-2009-3226SQL injection vulnerability in index.php in AlmondSoft Almon…
• CVE-2009-3227Cross-site scripting (XSS) vulnerability in index.php in Alm…
• CVE-2009-3228The tc_fill_tclass function in net/sched/sch_api.c in the tc…
• CVE-2009-3229The core server component in PostgreSQL 8.4 before 8.4.1, 8.…
• CVE-2009-3230The core server component in PostgreSQL 8.4 before 8.4.1, 8.…
• CVE-2009-3232pam-auth-update for PAM, as used in Ubuntu 8.10 and 9.4, and…
• CVE-2009-3233changetrack 4.3 allows local users to execute arbitrary comm…
• CVE-2009-3234Buffer overflow in the perf_copy_attr function in kernel/per…
• CVE-2009-3235Multiple stack-based buffer overflows in the Sieve plugin in…
• CVE-2009-3236The form library in Horde Application Framework 3.2 before 3…
• CVE-2009-3237Multiple cross-site scripting (XSS) vulnerabilities in Horde…