Vulnerability Details CVE-2009-3231
The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.05
EPSS Ranking 89.1%
CVSS Severity
CVSS v2 Score 6.8
References
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
- http://marc.info/?l=bugtraq&m=134124585221119&w=2
- http://marc.info/?l=bugtraq&m=134124585221119&w=2
- http://secunia.com/advisories/36660
- http://secunia.com/advisories/36727
- http://secunia.com/advisories/36800
- http://secunia.com/advisories/36837
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
- http://www.postgresql.org/docs/8.3/static/release-8-3-8.html
- http://www.postgresql.org/support/security.html
- http://www.securityfocus.com/archive/1/509917/100/0/threaded
- http://www.securityfocus.com/bid/36314
- http://www.ubuntu.com/usn/usn-834-1
- http://www.us.debian.org/security/2009/dsa-1900
- https://bugzilla.redhat.com/show_bug.cgi?id=522084
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
- http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
- http://marc.info/?l=bugtraq&m=134124585221119&w=2
- http://marc.info/?l=bugtraq&m=134124585221119&w=2
- http://secunia.com/advisories/36660
- http://secunia.com/advisories/36727
- http://secunia.com/advisories/36800
- http://secunia.com/advisories/36837
- http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
- http://www.postgresql.org/docs/8.3/static/release-8-3-8.html
- http://www.postgresql.org/support/security.html
- http://www.securityfocus.com/archive/1/509917/100/0/threaded
- http://www.securityfocus.com/bid/36314
- http://www.ubuntu.com/usn/usn-834-1
- http://www.us.debian.org/security/2009/dsa-1900
- https://bugzilla.redhat.com/show_bug.cgi?id=522084
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
- https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html
Products affected by CVE-2009-3231
-
cpe:2.3:a:postgresql:postgresql:8.2
-
cpe:2.3:a:postgresql:postgresql:8.2.0
-
cpe:2.3:a:postgresql:postgresql:8.2.1
-
cpe:2.3:a:postgresql:postgresql:8.2.10
-
cpe:2.3:a:postgresql:postgresql:8.2.11
-
cpe:2.3:a:postgresql:postgresql:8.2.12
-
cpe:2.3:a:postgresql:postgresql:8.2.13
-
cpe:2.3:a:postgresql:postgresql:8.2.2
-
cpe:2.3:a:postgresql:postgresql:8.2.3
-
cpe:2.3:a:postgresql:postgresql:8.2.4
-
cpe:2.3:a:postgresql:postgresql:8.2.5
-
cpe:2.3:a:postgresql:postgresql:8.2.6
-
cpe:2.3:a:postgresql:postgresql:8.2.7
-
cpe:2.3:a:postgresql:postgresql:8.2.8
-
cpe:2.3:a:postgresql:postgresql:8.2.9
-
cpe:2.3:a:postgresql:postgresql:8.3
-
cpe:2.3:a:postgresql:postgresql:8.3.0
-
cpe:2.3:a:postgresql:postgresql:8.3.1
-
cpe:2.3:a:postgresql:postgresql:8.3.2
-
cpe:2.3:a:postgresql:postgresql:8.3.3
-
cpe:2.3:a:postgresql:postgresql:8.3.4
-
cpe:2.3:a:postgresql:postgresql:8.3.5
-
cpe:2.3:a:postgresql:postgresql:8.3.6
-
cpe:2.3:a:postgresql:postgresql:8.3.7
-
cpe:2.3:o:canonical:ubuntu_linux:6.06
-
cpe:2.3:o:canonical:ubuntu_linux:8.04
-
cpe:2.3:o:canonical:ubuntu_linux:8.10
-
cpe:2.3:o:canonical:ubuntu_linux:9.04
-
cpe:2.3:o:fedoraproject:fedora:10
-
cpe:2.3:o:fedoraproject:fedora:11
-
cpe:2.3:o:opensuse:opensuse:10.3
-
cpe:2.3:o:opensuse:opensuse:10.3-11.1
-
cpe:2.3:o:opensuse:opensuse:11.0
-
cpe:2.3:o:opensuse:opensuse:11.1
-
cpe:2.3:o:suse:linux_enterprise:10.0
-
cpe:2.3:o:suse:linux_enterprise:11.0
-
cpe:2.3:o:suse:linux_enterprise_server:9