Vulnerability CVE-2014-2669

Vulnerability Name:

CVE-2014-2669 (CCN-94018)

Assigned:

2014-02-20

Published:

2014-02-20

Updated:

2017-12-16

Summary:

Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to have unspecified impact via vectors related to the (1) hstore_recv, (2) hstore_from_arrays, and (3) hstore_from_array functions in contrib/hstore/hstore_io.c; and the (4) hstoreArrayToPairs function in contrib/hstore/hstore_op.c, which triggers a buffer overflow.
Note: this issue was SPLIT from CVE-2014-0064 because it has a different set of affected versions.

CVSS v3 Severity:

5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

6.5 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
4.8 Medium (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
4.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

CWE-189

Vulnerability Consequences:

Gain Access

References:

Source: MITRE
Type: CNA
CVE-2014-2669

Source: REDHAT
Type: UNKNOWN
RHSA-2014:0221

Source: REDHAT
Type: UNKNOWN
RHSA-2014:0469

Source: CONFIRM
Type: Vendor Advisory
http://wiki.postgresql.org/wiki/20140220securityrelease

Source: DEBIAN
Type: UNKNOWN
DSA-2864

Source: DEBIAN
Type: UNKNOWN
DSA-2865

Source: CCN
Type: PostgreSQL Web Site
PostgreSQL 9.3.3, 9.2.7, 9.1.12, 9.0.16 and 8.4.20 released!

Source: CONFIRM
Type: Vendor Advisory
http://www.postgresql.org/about/news/1506/

Source: CONFIRM
Type: UNKNOWN
http://www.postgresql.org/support/security/

Source: CCN
Type: BID-66557
PostgreSQL CVE-2014-2669 Multiple Integer Overflow Vulnerabilities

Source: XF
Type: UNKNOWN
postgresql-cve20142669-bo(94018)

Source: CONFIRM
Type: UNKNOWN
https://github.com/postgres/postgres/commit/31400a673325147e1205326008e32135a78b4d8a

Source: CCN
Type: WhiteSource Vulnerability Database
CVE-2014-2669

Vulnerable Configuration:

Configuration 1:

cpe:/a:postgresql:postgresql:9.0:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.7:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.8:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.9:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.10:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.11:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.12:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.13:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.14:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.0.15:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.5:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.6:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.7:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.8:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.9:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.10:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.1.11:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.2:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.2.1:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.2.2:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.2.3:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.2.4:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.2.5:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.3:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.3.1:*:*:*:*:*:*:*

OR cpe:/a:postgresql:postgresql:9.3.2:*:*:*:*:*:*:*

Configuration CCN 1: