CVE-2007-4772
published 2008-01-09CVE-2007-4772: The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows…
PriorityP417medium4CVSS 2.0
AVNACLAuSCNINAP
EPSS
3.84%
88.9th percentile
The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| postgresql | postgresql | >= 7.4 < 7.4.19 | 7.4.19 |
| postgresql | postgresql | >= 8.0 < 8.0.15 | 8.0.15 |
| postgresql | postgresql | >= 8.1 < 8.1.11 | 8.1.11 |
| postgresql | postgresql | >= 8.2 < 8.2.6 | 8.2.6 |
| tcl | tcl_tk | < 8.4.17 | 8.4.17 |
| vmware | vmware_esxi | — | — |
| vmware | vmware_fusion | — | — |
| vmware | vmware_tools | — | — |
| vmware | vmware_workstation | — | — |
CVSS provenance
nvdv2.04.0MEDIUMAV:N/AC:L/Au:S/C:N/I:N/A:P
vendor_ubuntu6.9MEDIUM
vendor_redhat4.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
VMware
Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues
vendor_vmware·2008-06-04·CVSS 2.6
CVE-2006-1721 [LOW] Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues
VMSA-2008-0009: Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues
Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues VMware Security Advisory VMware Security AdvisoryAdvisory ID: VMware Security AdvisorySynopsis: Updates to VMware Workstation, VMware Player, VMware ACE, VMware Fusion, VMware Server, VMware VIX API, VMware ESX, VMware ESXi resolve critical security issues VMware Security AdvisoryIssue date: VMware Security AdvisoryUpdated on:
CVEs: CVE-2006-1721, CVE-2007-4772, CVE-2007-5378, CVE-2007-5671, CVE-2008-0062, CVE-2008-0063, CVE-2008-0553, CVE-2008-0888, CVE-2
Ubuntu
PostgreSQL vulnerabilities
vendor_ubuntu·2008-01-14·CVSS 6.9
CVE-2007-3278 [MEDIUM] PostgreSQL vulnerabilities
Title: PostgreSQL vulnerabilities
Summary: PostgreSQL vulnerabilities
Nico Leidecker discovered that PostgreSQL did not properly
restrict dblink functions. An authenticated user could exploit
this flaw to access arbitrary accounts and execute arbitrary
SQL queries. (CVE-2007-3278, CVE-2007-6601)
It was discovered that the TCL regular expression parser used
by PostgreSQL did not properly check its input. An attacker
could send crafted regular expressions to PostgreSQL and cause
a denial of service via resource exhaustion or database crash.
(CVE-2007-4769, CVE-2007-4772, CVE-2007-6067)
It was discovered that PostgreSQL executed VACUUM and ANALYZE
operations within index functions with superuser privileges and
also allowed SET ROLE and SET SESSION AUTHORIZATION within index
functions. A r
Red Hat
postgresql DoS via infinite loop in regex NFA optimization code
vendor_redhat·2008-01-07·CVSS 4.0
CVE-2007-4772 [MEDIUM] CWE-835 postgresql DoS via infinite loop in regex NFA optimization code
postgresql DoS via infinite loop in regex NFA optimization code
The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.
Package: tcl (Red Hat Enterprise Linux 4) - Will not fix
GHSA
GHSA-x3q3-v77f-cg26: The regular expression parser in TCL before 8
ghsa_unreviewed·2022-05-01
CVE-2007-4772 [MEDIUM] GHSA-x3q3-v77f-cg26: The regular expression parser in TCL before 8
The regular expression parser in TCL before 8.4.17, as used in PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, and 7.4 before 7.4.19, allows context-dependent attackers to cause a denial of service (infinite loop) via a crafted regular expression.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2007-4772 postgresql DoS via infinite loop in regex NFA optimization code
bugzilla·2007-10-03·CVSS 4.0
CVE-2007-4772 [MEDIUM] CVE-2007-4772 postgresql DoS via infinite loop in regex NFA optimization code
CVE-2007-4772 postgresql DoS via infinite loop in regex NFA optimization code
Will Drewry of the Google Security Team reported a problem in regular
expressions code use by PostreSQL which results in a non-terminating infinite
loop during
nondeterministic finite automata optimization. These loops remain
even after the client disconnects and can be used to hog CPU and
connections to the database until a full-fledged denial of service
condition occurs.
Discussion:
Note that these same looping behaviors have been reproduced in Tcl. Not sure if that should get its own
CVE or not.
---
If it's same code used in multiple products / projects (usually taken from one
project to another), single CVE id is usually used.
---
Public now, lifting embargo:
http://www.postgresql.org/about/news.905
h
Bugzilla
CVE-2007-4769 postgresql integer overflow in regex code
bugzilla·2007-10-02·CVSS 6.8
CVE-2007-4769 [MEDIUM] CVE-2007-4769 postgresql integer overflow in regex code
CVE-2007-4769 postgresql integer overflow in regex code
Will Drewry of Google Security Team has reported an integer overflow in regular
expression parsing code, which results in out of bound read and most frequently
in a crash. This crash affects worker process spawned for database connection,
but may have impact on main prostgresql processes and render database
unavailable for new connections.
Discussion:
Note that Postgres' regex library is borrowed lock-stock-and-barrel from Tcl, therefore this issue
probably affects Tcl too.
---
Tom, thanks for that info. It seems that there was more significant change in
regex component between 7.3 and 7.4. Are both version based on tcl?
---
No, the Tcl regex code was adopted in 7.4, so RHEL2.1 and RHEL3 are not affected.
I tried to reproduce
http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00049.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00052.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00054.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00056.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00016.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0122.htmlhttp://secunia.com/advisories/28359http://secunia.com/advisories/28376http://secunia.com/advisories/28437http://secunia.com/advisories/28438http://secunia.com/advisories/28454http://secunia.com/advisories/28455http://secunia.com/advisories/28464http://secunia.com/advisories/28477http://secunia.com/advisories/28479http://secunia.com/advisories/28679http://secunia.com/advisories/28698http://secunia.com/advisories/29070http://secunia.com/advisories/29248http://secunia.com/advisories/29638http://secunia.com/advisories/30535http://security.gentoo.org/glsa/glsa-200801-15.xmlhttp://securitytracker.com/id?1019157http://sourceforge.net/project/shownotes.php?release_id=565440&group_id=10894http://sourceforge.net/tracker/index.php?func=detail&aid=1810264&group_id=10894&atid=110894http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1http://www.debian.org/security/2008/dsa-1460http://www.debian.org/security/2008/dsa-1463http://www.mandriva.com/security/advisories?name=MDVSA-2008:004http://www.mandriva.com/security/advisories?name=MDVSA-2008:059http://www.postgresql.org/about/news.905http://www.redhat.com/support/errata/RHSA-2008-0038.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0040.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0134.htmlhttp://www.securityfocus.com/archive/1/485864/100/0/threadedhttp://www.securityfocus.com/archive/1/486407/100/0/threadedhttp://www.securityfocus.com/archive/1/493080/100/0/threadedhttp://www.securityfocus.com/bid/27163http://www.vmware.com/security/advisories/VMSA-2008-0009.htmlhttp://www.vupen.com/english/advisories/2008/0061http://www.vupen.com/english/advisories/2008/0109http://www.vupen.com/english/advisories/2008/1071/referenceshttp://www.vupen.com/english/advisories/2008/1744https://exchange.xforce.ibmcloud.com/vulnerabilities/39497https://issues.rpath.com/browse/RPL-1768https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11569https://usn.ubuntu.com/568-1/https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00397.htmlhttps://www.redhat.com/archives/fedora-package-announce/2008-January/msg00469.htmlhttp://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00049.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00052.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00054.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00056.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00016.htmlhttp://rhn.redhat.com/errata/RHSA-2013-0122.htmlhttp://secunia.com/advisories/28359http://secunia.com/advisories/28376http://secunia.com/advisories/28437http://secunia.com/advisories/28438http://secunia.com/advisories/28454http://secunia.com/advisories/28455http://secunia.com/advisories/28464http://secunia.com/advisories/28477http://secunia.com/advisories/28479http://secunia.com/advisories/28679http://secunia.com/advisories/28698http://secunia.com/advisories/29070http://secunia.com/advisories/29248http://secunia.com/advisories/29638http://secunia.com/advisories/30535http://security.gentoo.org/glsa/glsa-200801-15.xmlhttp://securitytracker.com/id?1019157http://sourceforge.net/project/shownotes.php?release_id=565440&group_id=10894http://sourceforge.net/tracker/index.php?func=detail&aid=1810264&group_id=10894&atid=110894http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1http://www.debian.org/security/2008/dsa-1460http://www.debian.org/security/2008/dsa-1463http://www.mandriva.com/security/advisories?name=MDVSA-2008:004http://www.mandriva.com/security/advisories?name=MDVSA-2008:059http://www.postgresql.org/about/news.905http://www.redhat.com/support/errata/RHSA-2008-0038.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0040.htmlhttp://www.redhat.com/support/errata/RHSA-2008-0134.htmlhttp://www.securityfocus.com/archive/1/485864/100/0/threadedhttp://www.securityfocus.com/archive/1/486407/100/0/threadedhttp://www.securityfocus.com/archive/1/493080/100/0/threadedhttp://www.securityfocus.com/bid/27163http://www.vmware.com/security/advisories/VMSA-2008-0009.htmlhttp://www.vupen.com/english/advisories/2008/0061http://www.vupen.com/english/advisories/2008/0109http://www.vupen.com/english/advisories/2008/1071/referenceshttp://www.vupen.com/english/advisories/2008/1744
+ 6 more references
2008-01-09
Published