CVE-2013-1901

Summary

PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions by calling the (1) pg_start_backup or (2) pg_stop_backup functions.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• http://www.postgresql.org/docs/current/static/release-9-2-4.html
• http://www.postgresql.org/about/news/1456/
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:142
• http://support.apple.com/kb/HT5892
• http://www.ubuntu.com/usn/USN-1789-1
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html
• http://www.postgresql.org/docs/current/static/release-9-1-9.html
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html
• http://www.debian.org/security/2013/dsa-2658
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html
• http://support.apple.com/kb/HT5880

References

• http://www.postgresql.org/docs/current/static/release-9-2-4.html
• http://www.postgresql.org/about/news/1456/
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00008.html
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00012.html
• http://www.mandriva.com/security/advisories?name=MDVSA-2013:142
• http://support.apple.com/kb/HT5892
• http://www.ubuntu.com/usn/USN-1789-1
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00002.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/102806.html
• http://lists.apple.com/archives/security-announce/2013/Sep/msg00004.html
• http://www.postgresql.org/docs/current/static/release-9-1-9.html
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00011.html
• http://www.debian.org/security/2013/dsa-2658
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00007.html
• http://lists.fedoraproject.org/pipermail/package-announce/2013-April/101519.html
• http://support.apple.com/kb/HT5880

• ←Previous
• Next→