CVE-2007-3278
published 2007-06-19CVE-2007-3278: PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote…
PriorityP433medium6.9CVSS 2.0
AVLACMAuNCCICAC
EPSS
1.26%
69.6th percentile
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.
Affected
15 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| postgresql | postgresql | — | — |
| postgresql | postgresql | >= 7.3 < 7.3.21 | 7.3.21 |
| postgresql | postgresql | >= 7.3.0 < 7.3.21 | 7.3.21 |
| postgresql | postgresql | >= 7.4 < 7.4.19 | 7.4.19 |
| postgresql | postgresql | >= 7.4.0 < 7.4.19 | 7.4.19 |
| postgresql | postgresql | >= 8.0 < 8.0.15 | 8.0.15 |
| postgresql | postgresql | >= 8.0.0 < 8.0.15 | 8.0.15 |
| postgresql | postgresql | >= 8.1 < 8.1.11 | 8.1.11 |
| postgresql | postgresql | >= 8.1.0 < 8.1.11 | 8.1.11 |
| postgresql | postgresql | >= 8.2 < 8.2.6 | 8.2.6 |
| postgresql | postgresql | >= 8.2.0 < 8.2.6 | 8.2.6 |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
vendor_redhat6.9MEDIUM
vendor_ubuntu6.9MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2008-01-14·CVSS 6.9
CVE-2007-3278 [MEDIUM] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: PostgreSQL vulnerabilities
Nico Leidecker discovered that PostgreSQL did not properly
restrict dblink functions. An authenticated user could exploit
this flaw to access arbitrary accounts and execute arbitrary
SQL queries. (CVE-2007-3278, CVE-2007-6601)
It was discovered that the TCL regular expression parser used
by PostgreSQL did not properly check its input. An attacker
could send crafted regular expressions to PostgreSQL and cause
a denial of service via resource exhaustion or database crash.
(CVE-2007-4769, CVE-2007-4772, CVE-2007-6067)
It was discovered that PostgreSQL executed VACUUM and ANALYZE
operations within index functions with superuser privileges and
also allowed SET ROLE and SET SESSION AUTHORIZATION within index
functions. A r
Red Hat
PostgreSQL privilege escalation via dblink
vendor_redhat·2008-01-07·CVSS 6.9
CVE-2007-6601 [MEDIUM] PostgreSQL privilege escalation via dblink
PostgreSQL privilege escalation via dblink
The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2007-3278.
Red Hat
dblink allows proxying of database connections via 127.0.0.1
vendor_redhat·2007-06-16·CVSS 6.9
CVE-2007-3278 [MEDIUM] dblink allows proxying of database connections via 127.0.0.1
dblink allows proxying of database connections via 127.0.0.1
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.
Statement: Red Hat does not consider this do be a security issue. dblink is disabled in default configuration of PostgreSQL packages as shipped with Red Hat Enterprise Linux versions 2.1, 3, 4 and 5, and it is a configuration decision whether to grant local users arbitrary access.
GHSA
GHSA-98mv-g9r2-mwm3: The DBLink module in PostgreSQL 8
ghsa_unreviewed·2022-05-01·CVSS 6.9
CVE-2007-6601 [MEDIUM] CWE-287 GHSA-98mv-g9r2-mwm3: The DBLink module in PostgreSQL 8
The DBLink module in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21, when local trust or ident authentication is used, allows remote attackers to gain privileges via unspecified vectors. NOTE: this issue exists because of an incomplete fix for CVE-2007-3278.
GHSA
GHSA-cf95-2h9h-gh2x: PostgreSQL 8
ghsa_unreviewed·2022-05-01
CVE-2007-3278 [MEDIUM] GHSA-cf95-2h9h-gh2x: PostgreSQL 8
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.
Suricata
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid INSERT
suricata·2010-07-30·CVSS 7.5
CVE-2007-0826 [HIGH] ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid INSERT
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid INSERT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid INSERT"; flow:established,to_server; http.uri; content:"/forum.asp?"; nocase; content:"forumid="; nocase; content:"INSERT"; nocase; content:"INTO"; nocase; distance:0; reference:cve,CVE-2007-0826; reference:url,www.exploit-db.com/exploits/3278/; classtype:web-application-attack; sid:2004981; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-0826 [HIGH] ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid SELECT
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid SELECT"; flow:established,to_server; http.uri; content:"/forum.asp?"; nocase; content:"forumid="; nocase; content:"SELECT"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0826; reference:url,www.exploit-db.com/exploits/3278/; classtype:web-application-attack; sid:2004979; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid ASCII
suricata·2010-07-30·CVSS 7.5
CVE-2007-0826 [HIGH] ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid ASCII
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid ASCII
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid ASCII"; flow:established,to_server; http.uri; content:"/forum.asp?"; nocase; content:"forumid="; nocase; content:"ASCII("; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0826; reference:url,www.exploit-db.com/exploits/3278/; classtype:web-application-attack; sid:2004983; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UPDATE
suricata·2010-07-30·CVSS 7.5
CVE-2007-0826 [HIGH] ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UPDATE
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UPDATE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UPDATE"; flow:established,to_server; http.uri; content:"/forum.asp?"; nocase; content:"forumid="; nocase; content:"UPDATE"; nocase; content:"SET"; nocase; distance:0; reference:cve,CVE-2007-0826; reference:url,www.exploit-db.com/exploits/3278/; classtype:web-application-attack; sid:2004984; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access,
Suricata
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid DELETE
suricata·2010-07-30·CVSS 7.5
CVE-2007-0826 [HIGH] ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid DELETE
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid DELETE
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid DELETE"; flow:established,to_server; http.uri; content:"/forum.asp?"; nocase; content:"forumid="; nocase; content:"DELETE"; nocase; content:"FROM"; nocase; distance:0; reference:cve,CVE-2007-0826; reference:url,www.exploit-db.com/exploits/3278/; classtype:web-application-attack; sid:2004982; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name Initial_Access
Suricata
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UNION SELECT
suricata·2010-07-30·CVSS 7.5
CVE-2007-0826 [HIGH] ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UNION SELECT
ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UNION SELECT
Rule: alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"ET WEB_SPECIFIC_APPS Kisisel Site 2007 SQL Injection Attempt -- forum.asp forumid UNION SELECT"; flow:established,to_server; http.uri; content:"/forum.asp?"; nocase; content:"forumid="; nocase; content:"UNION"; nocase; content:"SELECT"; nocase; distance:0; reference:cve,CVE-2007-0826; reference:url,www.exploit-db.com/exploits/3278/; classtype:web-application-attack; sid:2004980; rev:9; metadata:affected_product Web_Server_Applications, attack_target Web_Server, created_at 2010_07_30, deployment Datacenter, confidence Medium, signature_severity Major, tag SQL_Injection, updated_at 2020_09_11, mitre_tactic_id TA0001, mitre_tactic_name I
No public exploits indexed.
Bugzilla
CVE-2007-6601 PostgreSQL privilege escalation via dblink
bugzilla·2008-01-01·CVSS 6.9
CVE-2007-6601 [MEDIUM] CVE-2007-6601 PostgreSQL privilege escalation via dblink
CVE-2007-6601 PostgreSQL privilege escalation via dblink
privilege escalation via dblink (second attempt at fixing issue reported in
CVE-2007-3278; the previous patch fixed only some of the functions that expose
the hole)
Discussion:
Public now, lifting embargo:
http://www.postgresql.org/about/news.905
http://www.postgresql.org/support/security.html
---
postgresql-8.2.6-1.fc8 has been pushed to the Fedora 8 stable repository. If problems still persist, please make note of it in this bug report.
---
postgresql-8.2.6-1.fc7 has been pushed to the Fedora 7 stable repository. If problems still persist, please make note of it in this bug report.
---
This issue was addressed in:
Red Hat Application Stack:
http://rhn.redhat.com/errata/RHSA-2008-0040.html
Red Hat Enterprise Linux:
http:
Bugzilla
CVE-2007-3278 dblink allows proxying of database connections via 127.0.0.1
bugzilla·2007-09-27·CVSS 6.9
CVE-2007-3278 [MEDIUM] CVE-2007-3278 dblink allows proxying of database connections via 127.0.0.1
CVE-2007-3278 dblink allows proxying of database connections via 127.0.0.1
Common Vulnerabilities and Exposures assigned an identifier CVE-2007-3278 to the following vulnerability:
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.
References:
http://www.securityfocus.com/archive/1/archive/1/471541/100/0/threaded
http://www.securityfocus.com/archive/1/471644/100/0/threaded
http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt
http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf
Discussion:
Red Hat does not
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154http://osvdb.org/40899http://secunia.com/advisories/28376http://secunia.com/advisories/28437http://secunia.com/advisories/28438http://secunia.com/advisories/28445http://secunia.com/advisories/28454http://secunia.com/advisories/28477http://secunia.com/advisories/28479http://secunia.com/advisories/28679http://secunia.com/advisories/29638http://security.gentoo.org/glsa/glsa-200801-15.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1http://www.debian.org/security/2008/dsa-1460http://www.debian.org/security/2008/dsa-1463http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txthttp://www.mandriva.com/security/advisories?name=MDKSA-2007:188http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdfhttp://www.redhat.com/support/errata/RHSA-2008-0038.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0039.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0040.htmlhttp://www.securityfocus.com/archive/1/471541/100/0/threadedhttp://www.securityfocus.com/archive/1/471644/100/0/threadedhttp://www.vupen.com/english/advisories/2008/0109http://www.vupen.com/english/advisories/2008/1071/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/35142https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10334https://usn.ubuntu.com/568-1/http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154http://osvdb.org/40899http://secunia.com/advisories/28376http://secunia.com/advisories/28437http://secunia.com/advisories/28438http://secunia.com/advisories/28445http://secunia.com/advisories/28454http://secunia.com/advisories/28477http://secunia.com/advisories/28479http://secunia.com/advisories/28679http://secunia.com/advisories/29638http://security.gentoo.org/glsa/glsa-200801-15.xmlhttp://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1http://www.debian.org/security/2008/dsa-1460http://www.debian.org/security/2008/dsa-1463http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txthttp://www.mandriva.com/security/advisories?name=MDKSA-2007:188http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdfhttp://www.redhat.com/support/errata/RHSA-2008-0038.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0039.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0040.htmlhttp://www.securityfocus.com/archive/1/471541/100/0/threadedhttp://www.securityfocus.com/archive/1/471644/100/0/threadedhttp://www.vupen.com/english/advisories/2008/0109http://www.vupen.com/english/advisories/2008/1071/referenceshttps://exchange.xforce.ibmcloud.com/vulnerabilities/35142https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10334https://usn.ubuntu.com/568-1/
2007-06-19
Published