Visit our newest sister site!
Hundreds of free aircraft flight manuals
Civilian • Historical • Military • Declassified • FREE!

TUCoPS :: Web :: Apps :: bt1430.txt

postgresql remote code exec

Hash: SHA1


OpenPKG Security Advisory                            The OpenPKG Project                   
OpenPKG-SA-2003.047                                          30-Oct-2003

Package:             postgresql
Vulnerability:       remote code execution
OpenPKG Specific:    no

Affected Releases:   Affected Packages:           Corrected Packages:
OpenPKG CURRENT      <= postgresql-7.3.3-20030723 >= postgresql-7.3.4-20030725
OpenPKG 1.3          N.A.                         none
OpenPKG 1.2          <= postgresql-7.3.1-1.2.2    >= postgresql-7.3.1-1.2.3

Dependent Packages:  none

  Two bugs leading to a buffer overflow in the PostgreSQL [0] RDBMS,
  versions 7.2.x and 7.3.x prior to 7.3.4, were discovered. The
  vulnerability exists in the PostgreSQL abstract data type (ADT) to
  ASCII conversion functions.
  It has been conjectured that excessive data passed to the involved
  to_ascii_xxx() functions may overrun the bounds of an insufficient
  buffer reserved in heap memory, resulting in the corruption of heap
  based memory management structures that are adjacent to it. It is
  currently believed that under the correct circumstances an attacker
  may use this to execute arbitrary instructions in the context of the
  PostgreSQL server.
  The Common Vulnerabilities and Exposures (CVE) project assigned the id
  CAN-2003-0901 [1] to the problem.

  Please check whether you are affected by running "<prefix>/bin/rpm -q
  postgresql". If you have the "postgresql" package installed and its
  version is affected (see above), we recommend that you immediately
  upgrade it (see Solution). [2][3]

  Select the updated source RPM appropriate for the OpenPKG release
  [4], fetch it from the OpenPKG FTP service [5] or a mirror location,
  verify its integrity [6], build a corresponding binary RPM from it
  [2] and update your OpenPKG installation by applying the binary RPM
  [3]. For the release OpenPKG 1.2, perform the following operations
  to permanently fix the security problem (for other releases adjust

  $ ftp
  ftp> bin
  ftp> cd release/1.2/UPD
  ftp> get postgresql-7.3.1-1.2.3.src.rpm
  ftp> bye
  $ <prefix>/bin/rpm -v --checksig postgresql-7.3.1-1.2.3.src.rpm
  $ <prefix>/bin/rpm --rebuild postgresql-7.3.1-1.2.3.src.rpm
  $ su -
  # <prefix>/bin/rpm -Fvh <prefix>/RPM/PKG/postgresql-7.3.1-1.2.3.*.rpm


For security reasons, this advisory was digitally signed with the
OpenPGP public key "OpenPKG <>" (ID 63C4CB9F) of the
OpenPKG project which you can retrieve from and
hkp:// Follow the instructions on
for details on how to verify the integrity of this advisory.

Comment: OpenPKG <>


TUCoPS is optimized to look best in Firefox® on a widescreen monitor (1440x900 or better).
Site design & layout copyright © 1986-2015 AOH