Vulnerability Name:

CVE-2005-0227 (CCN-19183)

Assigned:2005-01-21
Published:2005-01-21
Updated:2017-10-11
Summary:PostgreSQL (pgsql) 7.4.x, 7.2.x, and other versions allows local users to load arbitrary shared libraries and execute code via the LOAD extension.
CVSS v3 Severity:5.9 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
Exploitability Metrics:Attack Vector (AV): Local
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): Low
Availibility (A): Low
CVSS v2 Severity:4.3 Medium (CVSS v2 Vector: AV:L/AC:L/Au:S/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
4.6 Medium (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)
Exploitability Metrics:Access Vector (AV): Local
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): Partial
Integrity (I): Partial
Availibility (A): Partial
Vulnerability Type:CWE-94
Vulnerability Consequences:Gain Privileges
References:Source: CCN
Type: SGI Security Advisory 20050207-01-U
SGI Advanced Linux Environment 3 Security Update #27

Source: MLIST
Type: Patch
[pgsql-announce] 20050201 PostgreSQL Security Release

Source: MLIST
Type: Vendor Advisory
[pgsql-bugs] 20050121 Privilege escalation via LOAD

Source: MITRE
Type: CNA
CVE-2005-0227

Source: CCN
Type: Conectiva Linux Security Announcement 2005-09-13 18:27:00
Fix for several PostgreSQL vulnerabilities

Source: BUGTRAQ
Type: UNKNOWN
20050201 [USN-71-1] PostgreSQL vulnerability

Source: CCN
Type: RHSA-2005-138
postgresql security update

Source: CCN
Type: RHSA-2005-141
rh-postgresql security update

Source: CCN
Type: RHSA-2005-150
postgresql security update

Source: CCN
Type: SA12948
PostgreSQL Multiple Vulnerabilities

Source: SECUNIA
Type: Patch, Vendor Advisory
12948

Source: GENTOO
Type: Patch
200502-08

Source: CCN
Type: CIAC Information Bulletin: P-139
PostgreSQL Vulnerabilities

Source: DEBIAN
Type: Patch, Vendor Advisory
DSA-668

Source: DEBIAN
Type: DSA-668
postgresql -- privilege escalation

Source: CCN
Type: GLSA-200502-08
PostgreSQL: Multiple vulnerabilities

Source: MANDRAKE
Type: UNKNOWN
MDKSA-2005:040

Source: SUSE
Type: UNKNOWN
SUSE-SA:2005:036

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2005:138

Source: REDHAT
Type: Patch, Vendor Advisory
RHSA-2005:150

Source: BID
Type: UNKNOWN
12411

Source: CCN
Type: BID-12411
PostgreSQL LOAD Extension Local Privilege Escalation Vulnerability

Source: TRUSTIX
Type: Patch, Vendor Advisory
2005-0003

Source: CCN
Type: TLSA-2005-22
Two vulnerabilities have been discovered in Postgresql

Source: CCN
Type: USN-71-1
PostgreSQL vulnerability

Source: CCN
Type: PostgreSQL FTP Web page
FTP Browser

Source: XF
Type: UNKNOWN
postgresql-load-gain-privileges(19183)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10234

Source: SUSE
Type: SUSE-SA:2005:036
sudo: race condition arbitrary code execution

Source: SUSE
Type: SUSE-SR:2005:005
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:postgresql:postgresql:7.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.7:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:*:*:*:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:postgresql:postgresql:7.2.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.5:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.6:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.2.7:*:*:*:*:*:*:*
  • AND
  • cpe:/o:debian:debian_linux:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:gentoo:linux:*:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:2.1:*:ws:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:8.2:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::ws:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::as:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.1:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:3::desktop:*:*:*:*:*
  • OR cpe:/o:conectiva:linux:10:*:*:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux_desktop:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:redhat:linux_advanced_workstation:2.1::itanium:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.1::x86-64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:*:*:home:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:10.0::amd64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:2.1::x86_64:*:*:*:*:*
  • OR cpe:/o:suse:suse_linux:9.3:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20050227
    V
    		CVE-2005-0227
    2015-11-16
    oval:org.mitre.oval:def:10234
    V
    		Buffer overflow in the readline function in util/texindex.c, as used by the (1) texi2dvi and (2) texindex commands, in texinfo 4.8 and earlier allows local users to execute arbitrary code via a crafted Texinfo file.
    2013-04-29
    oval:com.redhat.rhsa:def:20050138
    P
    		RHSA-2005:138: postgresql security update (Important)
    2005-02-15
    oval:com.redhat.rhsa:def:20050141
    P
    		RHSA-2005:141: rh-postgresql security update (Important)
    2005-02-14
    oval:org.debian:def:668
    V
    		privilege escalation
    2005-02-04
    BACK
    postgresql postgresql 7.2.1
    postgresql postgresql 7.2.2
    postgresql postgresql 7.2.3
    postgresql postgresql 7.2.4
    postgresql postgresql 7.2.5
    postgresql postgresql 7.2.6
    postgresql postgresql 7.2.7
    postgresql postgresql 7.4.1
    postgresql postgresql 7.4.2
    postgresql postgresql 7.4.3
    postgresql postgresql 7.4.4
    postgresql postgresql 7.4.5
    postgresql postgresql 7.4.6
    postgresql postgresql 7.4.7
    postgresql postgresql 7.2.1
    postgresql postgresql 7.2.2
    postgresql postgresql 7.4.3
    postgresql postgresql 7.2.3
    postgresql postgresql 7.2.4
    postgresql postgresql 7.4.1
    postgresql postgresql 7.4.2
    postgresql postgresql 7.4.4
    postgresql postgresql 7.4.5
    postgresql postgresql 7.4.6
    postgresql postgresql 7.4.7
    postgresql postgresql 7.2.5
    postgresql postgresql 7.2.6
    postgresql postgresql 7.2.7
    debian debian linux 3.0
    gentoo linux *
    mandrakesoft mandrake linux corporate server 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    redhat enterprise linux 2.1
    suse suse linux 8.2
    suse suse linux 9.0
    redhat enterprise linux 3
    redhat enterprise linux 3
    redhat enterprise linux 3
    mandrakesoft mandrake linux 10.0
    suse suse linux 9.1
    redhat enterprise linux 3
    conectiva linux 10
    suse suse linux 9.2
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux desktop 4.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat linux advanced workstation 2.1
    mandrakesoft mandrake linux 10.1
    mandrakesoft mandrake linux corporate server 3.0
    turbolinux turbolinux home *
    mandrakesoft mandrake linux 10.0
    mandrakesoft mandrake linux corporate server 2.1
    suse suse linux 9.3