Vulnerability Name:

CVE-2009-0922 (CCN-49219)

Assigned:2009-02-27
Published:2009-02-27
Updated:2018-10-10
Summary:PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Low
CVSS v2 Severity:4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.5 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P)
4.3 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:N/A:P/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
4.0 Medium (REDHAT CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P)
3.5 Low (REDHAT Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:N/I:N/A:P/E:H/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): None
Integrity (I): None
Availibility (A): Partial
Vulnerability Type:CWE-399
Vulnerability Consequences:Denial of Service
References:Source: MLIST
Type: Exploit
[pgsql-bugs] 20090227 Re: BUG #4680: Server crashed if using wrong (mismatch) conversion functions

Source: CCN
Type: pgsql-bugs Mailing List, Fri, 27 Feb 2009 10:40:44 GMT
BUG #4680: Server crashed if using wrong (mismatch) conversion functions

Source: MLIST
Type: Exploit
[pgsql-bugs] 20090227 BUG #4680: Server crashed if using wrong (mismatch) conversion functions

Source: CCN
Type: Debian Bug report logs - #517405
postgresql-8.3: Server crashes if using wrong (mismatch) conversion

Source: CONFIRM
Type: UNKNOWN
http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=517405

Source: MITRE
Type: CNA
CVE-2009-0922

Source: CCN
Type: HP Security Bulletin HPSBMU02781 SSRT100617
HP Network Node Manager i (NNMi) for HP-UX, Linux, Solaris, and Windows running PostgreSQL, Remote Execution of Arbitrary Code, Denial of Service (DoS)

Source: SUSE
Type: UNKNOWN
SUSE-SR:2009:009

Source: HP
Type: UNKNOWN
HPSBMU02781

Source: CCN
Type: RHSA-2009-1067
Moderate: Red Hat Application Stack v2.3 security and enhancement update

Source: CCN
Type: RHSA-2009-1484
Moderate: postgresql security update

Source: SECUNIA
Type: Vendor Advisory
34453

Source: CCN
Type: SA35100
Sun Solaris PostgreSQL Denial of Service Vulnerability

Source: SECUNIA
Type: Vendor Advisory
35100

Source: CCN
Type: SA49719
HP Network Node Manager i Multiple Vulnerabilities

Source: CCN
Type: SA49747
HP Network Node Manager i Multiple Vulnerabilities

Source: CCN
Type: SECTRACK ID: 1021860
PostgreSQL Encoding Conversion Error Lets Remote Authenticated Users Deny Service

Source: SUNALERT
Type: UNKNOWN
258808

Source: SUNALERT
Type: UNKNOWN
1020455

Source: CCN
Type: ASA-2009-199
Red Hat Application Stack v2.3 security and enhancement update (RHSA-2009-1067)

Source: CONFIRM
Type: UNKNOWN
http://wiki.rpath.com/Advisories:rPSA-2009-0086

Source: MANDRIVA
Type: UNKNOWN
MDVSA-2009:079

Source: MLIST
Type: UNKNOWN
[oss-security] 20090311 CVE request -- postgresql

Source: CCN
Type: OSVDB ID: 54512
PostgreSQL Client-specific Encoding Localized Error Message Conversion DoS

Source: CCN
Type: PostgreSQL Web site
PostgreSQL

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www.postgresql.org/about/news.1065

Source: REDHAT
Type: UNKNOWN
RHSA-2009:1067

Source: BUGTRAQ
Type: UNKNOWN
20090519 rPSA-2009-0086-1 postgresql postgresql-contrib postgresql-server

Source: BID
Type: Exploit, Patch
34090

Source: CCN
Type: BID-34090
PostgreSQL Conversion Encoding Remote Denial of Service Vulnerability

Source: SECTRACK
Type: UNKNOWN
1021860

Source: CCN
Type: TLSA-2009-14
postgresql denial of service

Source: CCN
Type: USN-753-1
PostgreSQL vulnerability

Source: VUPEN
Type: Patch, Vendor Advisory
ADV-2009-0767

Source: VUPEN
Type: Patch, Vendor Advisory
ADV-2009-1316

Source: CONFIRM
Type: UNKNOWN
https://bugzilla.redhat.com/show_bug.cgi?id=488156

Source: XF
Type: UNKNOWN
postgresql-conversion-functions-dos(49219)

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:10874

Source: OVAL
Type: UNKNOWN
oval:org.mitre.oval:def:6252

Source: FEDORA
Type: UNKNOWN
FEDORA-2009-2927

Source: FEDORA
Type: UNKNOWN
FEDORA-2009-2959

Source: SUSE
Type: SUSE-SR:2009:009
SUSE Security Summary Report

Vulnerable Configuration:Configuration 1:
  • cpe:/a:postgresql:postgresql:7.4.24:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.20:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.1.16:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.2.12:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:*

    • Configuration RedHat 1:
  • cpe:/o:redhat:enterprise_linux:4:*:*:*:*:*:*:*

    • Configuration RedHat 2:
  • cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*

    • Configuration RedHat 3:
  • cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*

    • Configuration RedHat 4:
  • cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*

    • Configuration RedHat 5:
  • cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*

    • Configuration RedHat 6:
  • cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*

    • Configuration RedHat 7:
  • cpe:/o:redhat:enterprise_linux:5::client:*:*:*:*:*

    • Configuration RedHat 8:
  • cpe:/o:redhat:enterprise_linux:5::client_workstation:*:*:*:*:*

    • Configuration RedHat 9:
  • cpe:/o:redhat:enterprise_linux:5::server:*:*:*:*:*

    • Configuration CCN 1:
  • cpe:/a:postgresql:postgresql:7.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.6:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.8:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.9:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.13:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.12:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.11:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.10:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.14:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.14:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.15:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.1.5:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.9:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.16:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.16:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.3.19:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:7.4.17:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.11:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.13:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.0.317:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.1.7:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.1.8:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.1.9:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.2.2:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.2.3:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.2.4:*:*:*:*:*:*:*
  • OR cpe:/a:postgresql:postgresql:8.3.6:*:*:*:*:*:*:*
  • AND
  • cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::as:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::desktop:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::es:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:4::ws:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:6.06::lts:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:4.0::x86_64:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux_corporate_server:3.0::x86_64:*:*:*:*:*
  • OR cpe:/o:turbolinux:turbolinux:fuji:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:*:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client_workstation:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0::x86-64:*:*:*:*:*
  • OR cpe:/o:redhat:enterprise_linux:5:*:client:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:x86_64:*:*:*:*:*:*
  • OR cpe:/a:redhat:rhel_application_stack:2:*:*:*:*:*:*:*
  • OR cpe:/o:mandrakesoft:mandrake_linux:2008.1:*:*:*:*:*:*:*
  • OR cpe:/o:canonical:ubuntu:8.04::lts:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:*:*:*:*:*:*:*
  • OR cpe:/o:mandriva:linux:2009.0:-:x86_64:*:*:*:*:*
  • OR cpe:/a:hp:network_node_manager_i:9.0:*:*:*:*:*:*:*
  • OR cpe:/a:hp:network_node_manager_i:8.0:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    Oval Definitions
    Definition IDClassTitleLast Modified
    oval:org.opensuse.security:def:20090922
    V
    		CVE-2009-0922
    2022-05-20
    oval:org.opensuse.security:def:29463
    P
    		Security update for xorg-x11-server (Important)
    2021-12-20
    oval:org.opensuse.security:def:32235
    P
    		Security update for openssh (Important)
    2021-12-06
    oval:org.opensuse.security:def:29427
    P
    		Security update for sqlite3 (Important)
    2021-09-23
    oval:org.opensuse.security:def:32101
    P
    		Security update for libwebp (Critical)
    2021-06-02
    oval:org.opensuse.security:def:32838
    P
    		Security update for openexr (Moderate)
    2020-12-23
    oval:org.opensuse.security:def:32015
    P
    		Security update for openssl (Important)
    2020-12-11
    oval:org.opensuse.security:def:32016
    P
    		Security update for python (Important)
    2020-12-11
    oval:org.opensuse.security:def:28436
    P
    		Security update for xen (Important)
    2020-12-01
    oval:org.opensuse.security:def:28005
    P
    		Security update for ant (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32794
    P
    		systemtap on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28641
    P
    		Security update for bind (Important)
    2020-12-01
    oval:org.opensuse.security:def:32328
    P
    		Security update for samba (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28017
    P
    		Security update for avahi (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33476
    P
    		Security update for libgdiplus0
    2020-12-01
    oval:org.opensuse.security:def:28729
    P
    		Security update for krb5
    2020-12-01
    oval:org.opensuse.security:def:32472
    P
    		Security update for xorg-x11-server (Important)
    2020-12-01
    oval:org.opensuse.security:def:28211
    P
    		Security update for libosip2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28789
    P
    		Security update for mysql (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32684
    P
    		ipsec-tools on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28352
    P
    		Security update for php53 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32027
    P
    		Security update for the Linux Kernel (Important)
    2020-12-01
    oval:org.opensuse.security:def:32772
    P
    		perl-spamassassin on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28588
    P
    		Security update for Mozilla NSS
    2020-12-01
    oval:org.opensuse.security:def:28006
    P
    		Security update for apache2 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28690
    P
    		Security update for foomatic-filters (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32385
    P
    		Security update for tightvnc (Important)
    2020-12-01
    oval:org.opensuse.security:def:28081
    P
    		Security update for gcc48 (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:33515
    P
    		Security update for PostgreSQL
    2020-12-01
    oval:org.opensuse.security:def:28745
    P
    		Security update for libgcrypt
    2020-12-01
    oval:org.opensuse.security:def:32628
    P
    		PolicyKit on GA media (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:28295
    P
    		Security update for ncurses (Moderate)
    2020-12-01
    oval:org.opensuse.security:def:32733
    P
    		libsnmp15-32bit on GA media (Moderate)
    2020-12-01
    oval:org.mitre.oval:def:28941
    P
    		RHSA-2009:1484 -- postgresql security update (Moderate)
    2015-08-17
    oval:org.mitre.oval:def:13288
    P
    		USN-753-1 -- postgresql-8.1, postgresql-8.3 vulnerability
    2014-06-30
    oval:org.mitre.oval:def:22642
    P
    		ELSA-2009:1484: postgresql security update (Moderate)
    2014-05-26
    oval:org.mitre.oval:def:10874
    V
    		PostgreSQL before 8.3.7, 8.2.13, 8.1.17, 8.0.21, and 7.4.25 allows remote authenticated users to cause a denial of service (stack consumption and crash) by triggering a failure in the conversion of a localized error message to a client-specified encoding, as demonstrated using mismatched encoding conversion requests.
    2013-04-29
    oval:com.redhat.rhsa:def:20091484
    P
    		RHSA-2009:1484: postgresql security update (Moderate)
    2009-10-07
    oval:org.mitre.oval:def:6252
    V
    		Security Vulnerability in PostgreSQL Shipped with Solaris may Allow a Denial of Service (DoS)
    2009-09-07
    BACK
    postgresql postgresql 7.4.24
    postgresql postgresql 8.0.20
    postgresql postgresql 8.1.16
    postgresql postgresql 8.2.12
    postgresql postgresql 8.3.6
    postgresql postgresql 7.3
    postgresql postgresql 7.4.3
    postgresql postgresql 8.0
    postgresql postgresql 8.2
    postgresql postgresql 7.4
    postgresql postgresql 7.3.1
    postgresql postgresql 7.3.2
    postgresql postgresql 7.3.3
    postgresql postgresql 7.4.1
    postgresql postgresql 7.4.2
    postgresql postgresql 7.4.4
    postgresql postgresql 7.4.5
    postgresql postgresql 7.4.6
    postgresql postgresql 7.4.7
    postgresql postgresql 7.3.4
    postgresql postgresql 7.3.6
    postgresql postgresql 7.3.8
    postgresql postgresql 7.3.9
    postgresql postgresql 8.0.1
    postgresql postgresql 8.0.2
    postgresql postgresql 8.0.5
    postgresql postgresql 8.0.4
    postgresql postgresql 8.0.3
    postgresql postgresql 8.1.1
    postgresql postgresql 7.4.11
    postgresql postgresql 7.4.10
    postgresql postgresql 7.4.9
    postgresql postgresql 7.4.8
    postgresql postgresql 7.3.13
    postgresql postgresql 7.3.12
    postgresql postgresql 7.3.11
    postgresql postgresql 7.3.10
    postgresql postgresql 8.1.3
    postgresql postgresql 8.0.7
    postgresql postgresql 7.3.14
    postgresql postgresql 7.4.12
    postgresql postgresql 8.1.4
    postgresql postgresql 8.0.8
    postgresql postgresql 7.4.14
    postgresql postgresql 7.4.13
    postgresql postgresql 7.3.15
    postgresql postgresql 8.1.5
    postgresql postgresql 8.0.9
    postgresql postgresql 7.4.16
    postgresql postgresql 7.3.16
    postgresql postgresql 7.3.19
    postgresql postgresql 7.4.17
    postgresql postgresql 8.0.11
    postgresql postgresql 8.0.13
    postgresql postgresql 8.0.317
    postgresql postgresql 8.1.7
    postgresql postgresql 8.1.8
    postgresql postgresql 8.1.9
    postgresql postgresql 8.2.2
    postgresql postgresql 8.2.3
    postgresql postgresql 8.2.4
    postgresql postgresql 8.3.6
    mandrakesoft mandrake linux corporate server 3.0
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    redhat enterprise linux 4
    canonical ubuntu 6.06
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 4.0
    mandrakesoft mandrake linux corporate server 3.0
    turbolinux turbolinux fuji
    redhat enterprise linux 5
    redhat enterprise linux 5
    mandrakesoft mandrake linux 2008.0
    redhat enterprise linux 5
    mandrakesoft mandrake linux 2008.0
    mandrakesoft mandrake linux 2008.1 x86_64
    redhat rhel application stack 2
    mandrakesoft mandrake linux 2008.1
    canonical ubuntu 8.04
    mandriva linux 2009.0
    mandriva linux 2009.0 -
    hp network node manager i 9.0
    hp network node manager i 8.0