31 december, 2009
<div><table width="50%">
<tbody>
<tr> </tr>
<tr>
<td valign="top" nowrap="nowrap" align="left"><strong>Category :</strong></td>
<td valign="top" colspan="2" nowrap="nowrap" align="left">Security</td>
</tr>
<tr>
<td valign="top" nowrap="nowrap" align="left"><strong>Release Phase :</strong></td>
<td valign="top" colspan="2" nowrap="nowrap" align="left">Workaround</td>
</tr>
<tr>
<td valign="top" nowrap="nowrap" align="left"><strong>Bug Id :</strong></td>
<td valign="top" nowrap="nowrap" align="left">6909139, 6909140, 6909142 </td>
</tr>
<tr>
<td valign="top" nowrap="nowrap" align="left"><strong>Product :</strong></td>
<td valign="top" nowrap="nowrap" align="left">Solaris 10 Operating System<br />
OpenSolaris </td>
</tr>
<tr>
<td valign="top" nowrap="nowrap" align="left"><strong>Date of Workaround Release :</strong></td>
<td valign="top" nowrap="nowrap" align="left">24-Dec-2009 </td>
</tr>
<tr>
<td></TR></td>
</tr>
</tbody>
</table>
</div>
<br />
<p>Security Vulnerabilities in PostgreSQL Shipped With Solaris May Allow Escalation of Privileges or Man-in-the-Middle on SSL Connections</p>
<br />
<br />
1. Impact<br />
<br />
Multiple security vulnerabilities have been identified in the PostgreSQL software shipped with Solaris. These vulnerabilities may allow a remote authenticated user with certain privileges to gain extra privileges via a table with a crafted index function. Further vulnerabilities may allow man-in-the-middle attacks on SSL based PostgreSQL servers by substituting malicious SSL certificates for trusted ones.<br />
<br />
These issues are described in the following documents:<br />
<br />
<div>Official PostgreSQL annoucement at <a href="http://www.postgresql.org/about/news.1170">http://www.postgresql.org/about/news.1170</a><br />
</div>
<div>CVE-2009-4034 at <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4034">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4034</a><br />
CVE-2009-4136 at <a href="http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4136">http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2009-4136</a><br />
</div>
<br />
2. Contributing Factors<br />
<br />
These issues can occur in the following releases:<br />
<br />
SPARC Platform<br />
<ul>
<li>Solaris 10 6/06 (or later) PostgreSQL 8.1</li>
<li>Solaris 10 8/07 (or later) PostgreSQL 8.2</li>
<li>Solaris 10 10/08 (or later) PostgreSQL 8.3</li>
<li>OpenSolaris PostgreSQL 8.1 based upon builds snv_35 through snv_109</li>
<li>OpenSolaris PostgreSQL 8.2 based upon builds snv_56 through snv_130</li>
<li>OpenSolaris PostgreSQL 8.3 based upon builds snv_87 through snv_130</li>
</ul>
x86 Platform<br />
<ul>
<li>Solaris 10 6/06 (or later) PostgreSQL 8.1</li>
<li>Solaris 10 8/07 (or later) PostgreSQL 8.2</li>
<li>Solaris 10 10/08 (or later) PostgreSQL 8.3</li>
<li>OpenSolaris PostgreSQL 8.1 based upon builds snv_35 through snv_109</li>
<li>OpenSolaris PostgreSQL 8.2 based upon builds snv_56 through snv_130</li>
<li>OpenSolaris PostgreSQL 8.3 based upon builds snv_87 through snv_130<br />
</li>
</ul>
Notes:<br />
<br />
1. Solaris 8 and 9 do not ship with PostgreSQL and are not impacted by these issues.<br />
<br />
2. A user must have an account on the PostgreSQL server to exploit the issue described in CVE-2009-4136.<br />
<br />
3. The CVE-2009-4034 and CVE-2009-4136 issues affect PostgreSQL 7.4.x prior to 7.4.27, 8.0.x prior to 8.0.23, 8.1.x prior to 8.1.19, 8.2.x prior to 8.2.15 and 8.3.x prior to 8.3.9 and versions 8.4.x prior to 8.4.2.<br />
<br />
4. PostgreSQL 8.1 (SUNWpostgr), 8.2 (packages beginning with SUNWpostgr-82) and 8.3 (packages beginning with SUNWpostgr-83) can be installed at the same time and are separately impacted by these vulnerabilities.<br />
<br />
To determine if a version of PostgreSQL is installed, a command such as the following can be used:<br />
<p>$ pkginfo | grep SUNWpostgr<br />system SUNWpostgr PostgreSQL 8.1.9 client programs and libraries<br />system SUNWpostgr-82-client PostgreSQL 8.2 client tools</p>
To determine if PostgreSQL is running on a server, a command such as the following can be run as the user 'postgres' (or the 'root' user):<br />
<br />
for PostgreSQL 8.1:<br />
<p>$ pg_ctl status -D /var/lib/pgsql/data/<br />pg_ctl: neither postmaster nor postgres running</p>
for PostgreSQL 8.2:<br />
<p>$ /usr/postgres/8.2/bin/pg_ctl status -D /var/postgres/8.2/data/<br />pg_ctl: server is running (PID: 395)</p>
for PostgreSQL 8.3:<br />
<p>$ /usr/postgres/8.3/bin/pg_ctl status -D /var/postgres/8.3/data/<br />pg_ctl: server is running (PID: 395)</p>
or (where applicable):<br />
<p>$ svcs -a | grep postgresql<br />disabled 17:12:37 svc:/application/database/postgresql_83:default_32bit<br />disabled 17:12:37 svc:/application/database/postgresql:version_82<br />disabled 17:12:37 svc:/application/database/postgresql:version_82_64bit<br />online 17:13:05 svc:/application/database/postgresql_83:default_64bit</p>
<br />
3. Symptoms<br />
<br />
There are no predictable symptoms that would indicate the described issues have been exploited.<br />
<br />
4. Workaround<br />
<br />
To prevent the issue described in CVE-2009-4136 from being freshly exploited, the database administrator can revoke the "create" privilege from users by running the following commands:<br />
<br />
<div>REVOKE CREATE ON SCHEMA <schema> FROM <user>;<br />
</div>
<br />
or<br />
<br />
<div>REVOKE CREATE ON TABLESPACE <tablespace> FROM <user>;<br />
</div>
<br />
Preliminary T-Patches are available for the following releases from <a href="http://sunsolve.sun.com/tpatches:">http://sunsolve.sun.com/tpatches:</a><br />
<br />
<strong>SPARC Platform</strong><br />
<ul>
<li>Solaris 10 6/06 (or later) PostgreSQL 8.1 T-patch T123590-12</li>
<li>Solaris 10 8/07 (or later) PostgreSQL 8.2 T-patch T136998-08</li>
<li>Solaris 10 10/08 (or later) PostgreSQL 8.3 T-patch T138826-06</li>
</ul>
<strong>x86 Platform</strong><br />
<ul>
<li>Solaris 10 6/06 (or later) PostgreSQL 8.1 T-patch T123591-12</li>
<li>Solaris 10 8/07 (or later) PostgreSQL 8.2 T-patch T136999-08</li>
<li>Solaris 10 10/08 (or later) PostgreSQL 8.3 T-patch T138827-06</li>
</ul>
This document refers to one or more preliminary temporary patches (T-Patches) which are designed to address the concerns identified herein. Sun has limited experience with these patches due to their preliminary nature. As such, you should only install the patches on systems meeting the configurations described above. Sun may release full patches at a later date, however, Sun is under no obligation whatsoever to create, release, or distribute any such patch.<br />
<br />
5. Resolution<br />
<br />
These issues are addressed in the following releases:<br />
<br />
SPARC Platform<br />
<ul>
<li>OpenSolaris PostgreSQL 8.1 based upon builds snv_110 or later</li>
<li>OpenSolaris PostgreSQL 8.2 based upon builds snv_131 or later</li>
<li>OpenSolaris PostgreSQL 8.3 based upon builds snv_131 or later</li>
</ul>
x86 Platform<br />
<ul>
<li>OpenSolaris PostgreSQL 8.1 based upon builds snv_110 or later</li>
<li>OpenSolaris PostgreSQL 8.2 based upon builds snv_131 or later</li>
<li>OpenSolaris PostgreSQL 8.3 based upon builds snv_131 or later</li>
</ul>
Note PostgreSQL 8.1 was removed from OpenSolaris snv_110 onwards.<br />
<br />
A final resolution is pending completion for Solaris 10.<br />
<br />
For more information <span id="PageLayoutRN">on Security Sun Alerts, see <a href="http://sunsolve.sun.com/search/document.do?assetkey=1-61-213557-1">Technical Instruction ID 213557</a>. </span><br />
<br />
This Sun Alert notification is being provided to you on an "AS IS" basis. This Sun Alert notification may contain information provided by third parties. The issues described in this Sun Alert notification may or may not impact your system(s). Sun makes no representations, warranties, or guarantees as to the information contained herein. ANY AND ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING WITHOUT LIMITATION WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, OR NON-INFRINGEMENT, ARE HEREBY DISCLAIMED. BY ACCESSING THIS DOCUMENT YOU ACKNOWLEDGE THAT SUN SHALL IN NO EVENT BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, PUNITIVE, OR CONSEQUENTIAL DAMAGES THAT ARISE OUT OF YOUR USE OR FAILURE TO USE THE INFORMATION CONTAINED HEREIN. This Sun Alert notification contains Sun proprietary and confidential information. It is being provided to you pursuant to the provisions of your agreement to purchase services from Sun, or, if you do not have such an agreement, the Sun.com Terms of Use. This Sun Alert notification may only be used for the purposes contemplated by these agreements. <br />
<br />
Copyright 2000-2009 Sun Microsystems, Inc., 4150 Network Circle, Santa Clara, CA 95054 U.S.A. All rights reserved.