-----BEGIN PGP SIGNED MESSAGE----- //@(#) Mordred Labs advisory 0x0007 Release date: August 26, 2002 Name: Remote DoS condition in PostgreSQL Versions affected: <= 7.2.2 Conditions: entry in a pg_hba.conf file that matches attacker's host. Risk: average Author: Sir Mordred (http://mslabs.iwebland.com) I. Description: PostgreSQL is an advanced object-relational database management system that supports an extended subset of the SQL standard, including transactions, foreign keys, subqueries, triggers, user-defined types and functions. Check http://www.postgresql.org for more information. Upon connecting to a database, postmaster will fork a new process. After that, a child process will call a src/backend/postmaster/postmaster.c:DoBackend() routine, which after processing a startup packet (see src/include/libpq/pqcomm.h), will invoke a src/backend/libpq/auth.c:ClientAuthentication() routine to perform client authentication. If there is an entry in pg_hba.conf file, that matches an attacker's host, an attacker could trigger invocation of src/backend/libpq/auth.c:recv_and_check_password0(), which fails to detect a DoS condition. II. Details: Consider this snip of code from src/backend/libpq/auth.c: [snip] static int recv_and_check_password0(Port *port) { int32 len; char *buf; if (pq_getint(&len, 4) == EOF) return STATUS_EOF; len -= 4; buf = palloc(len); /* len is taken from a packet */ [snip] Note, that the size of palloced memory is taken from the user's input. III. How to reproduce: It's clear from the advisory how to reproduce this. IV. Solution Disable network access for untrusted users. -----BEGIN PGP SIGNATURE----- Version: Hush 2.2 (Java) Note: This signature can be verified at https://www.hushtools.com/verify wmAEARECACAFAj5vXM4ZHHNpci5tb3JkcmVkQGh1c2htYWlsLmNvbQAKCRAOkXvN4BZr fHUdAKCtv+xPETQZLluTxHWgfIIcbDprwwCgsOtI5Qjzf0P2EwCFtowTdD9HsC4= =9INs -----END PGP SIGNATURE----- Concerned about your privacy? Follow this link to get FREE encrypted email: https://www.hushmail.com/?l=2 Big $$$ to be made with the HushMail Affiliate Program: https://www.hushmail.com/about.php?subloc=affiliate&l=427
This archive was generated by hypermail 2b30 : Wed Mar 12 2003 - 10:57:14 PST