CVE-2007-2138
published 2007-04-24CVE-2007-2138: Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows…
PriorityP425medium6CVSS 2.0
AVNACMAuSCPIPAP
EPSS
3.69%
89.7th percentile
Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| postgresql | postgresql | < 7.3.19 | 7.3.19 |
| postgresql | postgresql | >= 7.4 < 7.4.17 | 7.4.17 |
| postgresql | postgresql | >= 8.0 < 8.0.13 | 8.0.13 |
| postgresql | postgresql | >= 8.1 < 8.1.9 | 8.1.9 |
| postgresql | postgresql | >= 8.2 < 8.2.4 | 8.2.4 |
CVSS provenance
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
vendor_redhat6.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-2hq5-m4w6-6x9c: Untrusted search path vulnerability in PostgreSQL before 7
ghsa_unreviewed·2022-05-01
CVE-2007-2138 [MEDIUM] GHSA-2hq5-m4w6-6x9c: Untrusted search path vulnerability in PostgreSQL before 7
Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."
Ubuntu
PostgreSQL vulnerability
vendor_ubuntu·2007-04-27
CVE-2007-2138 PostgreSQL vulnerability
Title: PostgreSQL vulnerability
Summary: PostgreSQL vulnerability
PostgreSQL did not handle the "search_path" configuration option in a
secure way for functions declared as "SECURITY DEFINER".
Previously, an attacker could override functions and operators used by
the security definer function to execute arbitrary SQL commands with
the privileges of the user who created the security definer function.
The updated version does not search the temporary table schema for
functions and operators any more.
Similarly, an attacker could put forged tables into the temporary
table schema to trick the security definer function into using
attacker defined data for processing. This was possible because the
temporary schema was always implicitly searched first before all other
entries in "search_path"
Red Hat
PostgreSQL security-definer function privilege escalation
vendor_redhat·2007-04-23·CVSS 6.0
CVE-2007-2138 [MEDIUM] PostgreSQL security-definer function privilege escalation
PostgreSQL security-definer function privilege escalation
Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2019-10208 postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution
bugzilla·2019-07-30·CVSS 6.0
CVE-2019-10208 [MEDIUM] CVE-2019-10208 postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution
CVE-2019-10208 postgresql: TYPE in pg_temp executes arbitrary SQL during SECURITY DEFINER execution
Given a suitable SECURITY DEFINER function, an attacker can execute arbitrary
SQL under the identity of the function owner. An attack requires EXECUTE
permission on the function, which must itself contain a function call having
inexact argument type match. For example, length('foo'::varchar) and
length('foo') are inexact, while length('foo'::text) is exact. As part of
exploiting this vulnerability, the attacker uses CREATE DOMAIN to create a
type in a pg_temp schema. The attack pattern and fix are similar to that for
CVE-2007-2138. Writing SECURITY DEFINER functions continues to require
following the considerations noted in the documentation, though this
vulnerability affects functions obse
Bugzilla
CVE-2009-3230 postgresql: SQL privilege escalation, incomplete fix for CVE-2007-6600
bugzilla·2009-09-09·CVSS 6.0
CVE-2009-3230 [MEDIUM] CVE-2009-3230 postgresql: SQL privilege escalation, incomplete fix for CVE-2007-6600
CVE-2009-3230 postgresql: SQL privilege escalation, incomplete fix for CVE-2007-6600
Quoting upstream PostgreSQL security page:
http://www.postgresql.org/support/security.html
The fix for issue CVE-2007-2138 (below) failed to include protection
against misuse of RESET SESSION AUTHORIZATION.
Affected versions: 8.4, 8.3, 8.2, 8.1, 8.0, 7.4
(note: this may affect previous 7.x versions too, but upstream does not
support pre-7.4 versions any more)
Fixed in versions: 8.4.1, 8.3.8, 8.2.14, 8.1.18, 8.0.22, 7.4.26
Severity: C - A vulnerabilty that is exploitable for privilege escalation, but requiring a valid prior login.
CVE-2007-2138 was previously tracked via bug #237680 and bug #237682, more info on the updates addressing this flaw is available at:
https://www.redhat.com/security/data/cve
Bugzilla
CVE-2007-2138 SECURITY DEFINER related privilege escalation in PostgreSQL
bugzilla·2007-04-25·CVSS 6.0
CVE-2007-2138 [MEDIUM] CVE-2007-2138 SECURITY DEFINER related privilege escalation in PostgreSQL
CVE-2007-2138 SECURITY DEFINER related privilege escalation in PostgreSQL
Description of problem:
PostgreSQL released a security update that reportedly fixes a bug, that
allowed unprivileged users execute code with privilegies of SECURITY
DEFINER functions.
See URL for details.
Discussion:
Tom, as PostgreSQL is far beyond the scope of my understanding, could you
please help me determine the following:
1.) whether the flaw affects the 7.1 line, as used in RHEL2.1? I assume it
affects other supported releases, as update was released for the respective
version lines?
2.) how serious the bug is. Is this similar to #156726, where an authenticated
users user could gain superuser rights? Or is it less likely to be exploited?
I have no idea what a SECURITY DEFINER is, and in with what privi
Bugzilla
CVE-2007-2138 SECURITY DEFINER related privilege escalation in PostgreSQL
bugzilla·2007-04-25·CVSS 6.0
CVE-2007-2138 [MEDIUM] CVE-2007-2138 SECURITY DEFINER related privilege escalation in PostgreSQL
CVE-2007-2138 SECURITY DEFINER related privilege escalation in PostgreSQL
+++ This bug was initially created as a clone of Bug #237823 +++
Description of problem:
PostgreSQL released a security update that reportedly fixes a bug, that
allowed unprivileged users execute code with privilegies of SECURITY
DEFINER functions.
See URL for details.
Discussion:
*** This bug has been marked as a duplicate of 237682 ***
Bugzilla
CVE-2007-2138 PostgreSQL security-definer function privilege escalation
bugzilla·2007-04-24·CVSS 6.0
CVE-2007-2138 [MEDIUM] CVE-2007-2138 PostgreSQL security-definer function privilege escalation
CVE-2007-2138 PostgreSQL security-definer function privilege escalation
Quoting the PostgreSQL release notes:
http://www.postgresql.org/docs/8.2/static/release-8-2-4.html
Support explicit placement of the temporary-table schema within search_path,
and disable searching it for functions and operators (Tom)
This is needed to allow a security-definer function to set a truly secure
value of search_path. Without it, an unprivileged SQL user can use temporary
objects to execute code with the privileges of the security-definer function
(CVE-2007-2138). See CREATE FUNCTION for more information.
This flaw also affects RHEL 3 and 4
Discussion:
I've built the following:
RHEL5 postgresql-8.1.9-1.el5
RHEL4 postgresql-7.4.17-1.RHEL4.1
RHEL3 rh-postgresql-7.3.19-1
but just now realized that they a
Bugzilla
CVE-2007-2138 PostgreSQL security-definer function privilege escalation
bugzilla·2007-04-24·CVSS 6.0
CVE-2007-2138 [MEDIUM] CVE-2007-2138 PostgreSQL security-definer function privilege escalation
CVE-2007-2138 PostgreSQL security-definer function privilege escalation
+++ This bug was initially created as a clone of Bug #237680 +++
Quoting the PostgreSQL release notes:
http://www.postgresql.org/docs/8.2/static/release-8-2-4.html
Support explicit placement of the temporary-table schema within search_path,
and disable searching it for functions and operators (Tom)
This is needed to allow a security-definer function to set a truly secure
value of search_path. Without it, an unprivileged SQL user can use temporary
objects to execute code with the privileges of the security-definer function
(CVE-2007-2138). See CREATE FUNCTION for more information.
This flaw also affects FC5 and FC7
Discussion:
I've built the following:
F7 postgresql-8.2.4-1.fc7
FC6 postgresql-8.1.9-1.fc6
FC5 post
Bugzilla
CVE-2007-2138 PostgreSQL security-definer function privilege escalation
bugzilla·2007-04-24·CVSS 6.0
CVE-2007-2138 [MEDIUM] CVE-2007-2138 PostgreSQL security-definer function privilege escalation
CVE-2007-2138 PostgreSQL security-definer function privilege escalation
+++ This bug was initially created as a clone of Bug #237680 +++
Quoting the PostgreSQL release notes:
http://www.postgresql.org/docs/8.2/static/release-8-2-4.html
Support explicit placement of the temporary-table schema within search_path,
and disable searching it for functions and operators (Tom)
This is needed to allow a security-definer function to set a truly secure
value of search_path. Without it, an unprivileged SQL user can use temporary
objects to execute code with the privileges of the security-definer function
(CVE-2007-2138). See CREATE FUNCTION for more information.
Discussion:
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
clos
http://rhn.redhat.com/errata/RHSA-2007-0336.htmlhttp://secunia.com/advisories/24989http://secunia.com/advisories/24999http://secunia.com/advisories/25005http://secunia.com/advisories/25019http://secunia.com/advisories/25037http://secunia.com/advisories/25058http://secunia.com/advisories/25184http://secunia.com/advisories/25238http://secunia.com/advisories/25334http://secunia.com/advisories/25717http://secunia.com/advisories/25720http://secunia.com/advisories/25725http://security.gentoo.org/glsa/glsa-200705-12.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102894-1http://support.avaya.com/elmodocs2/security/ASA-2007-190.htmhttp://www.debian.org/security/2007/dsa-1309http://www.debian.org/security/2007/dsa-1311http://www.mandriva.com/security/advisories?name=MDKSA-2007:094http://www.postgresql.org/about/news.791http://www.postgresql.org/support/security.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0337.htmlhttp://www.securityfocus.com/bid/23618http://www.securitytracker.com/id?1017974http://www.trustix.org/errata/2007/0015/http://www.ubuntu.com/usn/usn-454-1http://www.vupen.com/english/advisories/2007/1497http://www.vupen.com/english/advisories/2007/1549https://exchange.xforce.ibmcloud.com/vulnerabilities/33842https://issues.rpath.com/browse/RPL-1292https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10090http://rhn.redhat.com/errata/RHSA-2007-0336.htmlhttp://secunia.com/advisories/24989http://secunia.com/advisories/24999http://secunia.com/advisories/25005http://secunia.com/advisories/25019http://secunia.com/advisories/25037http://secunia.com/advisories/25058http://secunia.com/advisories/25184http://secunia.com/advisories/25238http://secunia.com/advisories/25334http://secunia.com/advisories/25717http://secunia.com/advisories/25720http://secunia.com/advisories/25725http://security.gentoo.org/glsa/glsa-200705-12.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-102894-1http://support.avaya.com/elmodocs2/security/ASA-2007-190.htmhttp://www.debian.org/security/2007/dsa-1309http://www.debian.org/security/2007/dsa-1311http://www.mandriva.com/security/advisories?name=MDKSA-2007:094http://www.postgresql.org/about/news.791http://www.postgresql.org/support/security.htmlhttp://www.redhat.com/support/errata/RHSA-2007-0337.htmlhttp://www.securityfocus.com/bid/23618http://www.securitytracker.com/id?1017974http://www.trustix.org/errata/2007/0015/http://www.ubuntu.com/usn/usn-454-1http://www.vupen.com/english/advisories/2007/1497http://www.vupen.com/english/advisories/2007/1549https://exchange.xforce.ibmcloud.com/vulnerabilities/33842https://issues.rpath.com/browse/RPL-1292https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10090
2007-04-24
Published