Vulnerability Name:

CVE-2002-1399 (CCN-11509)

Assigned:2002-08-19
Published:2002-08-19
Updated:2016-10-18
Summary:Unknown vulnerability in cash_out and possibly other functions in PostgreSQL 7.2.1 and earlier, and possibly later versions before 7.2.3, with unknown impact, based on an invalid integer input which is processed as a different data type, as demonstrated using cash_out(2).
CVSS v3 Severity:10.0 Critical (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Changed
Impact Metrics:Confidentiality (C): High
Integrity (I): High
Availibility (A): High
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
10.0 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
Vulnerability Type:CWE-Other
Vulnerability Consequences:Denial of Service
References:Source: CCN
Type: pgsql-hackers Mailing List, Mon, 12 Aug 2002 00:33:27 -0400 (CLT)
cash_out bug

Source: MISC
Type: UNKNOWN
http://archives.postgresql.org/pgsql-hackers/2002-08/msg00708.php

Source: CCN
Type: pgsql-hackers Mailing List, Mon, 12 Aug 2002 01:30:38 -0400
Re: cash_out bug

Source: MISC
Type: UNKNOWN
http://archives.postgresql.org/pgsql-hackers/2002-08/msg00713.php

Source: MITRE
Type: CNA
CVE-2002-1399

Source: BUGTRAQ
Type: UNKNOWN
20020819 Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in PostgreSQL

Source: CCN
Type: BugTraq Mailing List, 2002-08-19 17:30:52
Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in PostgreSQL

Source: CCN
Type: OSVDB ID: 6191
PostgreSQL Multiple Function Invalid Integer Input DoS

Source: XF
Type: UNKNOWN
postgresql-nonpointer-integer-dos(11509)

Vulnerable Configuration:Configuration 1:
  • cpe:/a:postgresql:postgresql:6.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:6.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.1:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:postgresql:postgresql:7.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:6.5.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:6.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.1.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.1.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    postgresql postgresql 6.3.2
    postgresql postgresql 6.5.3
    postgresql postgresql 7.0.3
    postgresql postgresql 7.1
    postgresql postgresql 7.1.1
    postgresql postgresql 7.1.2
    postgresql postgresql 7.1.3
    postgresql postgresql 7.2
    postgresql postgresql 7.2.1
    postgresql postgresql 7.2.1
    postgresql postgresql 7.2
    postgresql postgresql 6.5.3
    postgresql postgresql 6.3.2
    postgresql postgresql 7.0.3
    postgresql postgresql 7.1
    postgresql postgresql 7.1.1
    postgresql postgresql 7.1.2
    postgresql postgresql 7.1.3