From: | Bruce Momjian <pgman(at)candle(dot)pha(dot)pa(dot)us> |
---|---|
To: | Gavin Sherry <swm(at)linuxworld(dot)com(dot)au> |
Cc: | Neil Conway <neilc(at)samurai(dot)com>, "Marc G(dot) Fournier" <scrappy(at)hub(dot)org>, PostgreSQL Hackers <pgsql-hackers(at)postgresql(dot)org> |
Subject: | Re: [GENERAL] PostgreSQL 7.2.2: Security Release |
Date: | 2002-08-25 14:34:29 |
Message-ID: | 200208251434.g7PEYT712817@candle.pha.pa.us |
Views: | Raw Message | Whole Thread | Download mbox | Resend email |
Thread: | |
Lists: | pgsql-announce pgsql-general pgsql-hackers |
OK, I understand your point. What do we need to do now that the
announcement has already been made?
---------------------------------------------------------------------------
Gavin Sherry wrote:
> On Sat, 24 Aug 2002, Bruce Momjian wrote:
>
> >
> > The issue is data-provoked crashes vs. query-invoked crashes. Marc's
> > point, and I think it was clear enough, is that you can't just poke at
> > the TCP port and hope to do anything bad, which was the thrust of the
> > argument, I think.
>
> Bruce,
>
> I am convinced that someone with enough time on their hands and some code
> pointed to by Florian Weimer could exploit the datetime overrun issue by
> crafting a datetime string in such a way as to overrun the buffer and
> smash the stack.
>
> In applications which pass date/time data directly to the database without
> any validation (is this datetime string greater than 52 bytes? does it
> look like a date/time string?) then a malicious user without direct
> database access could crash the database by taking advantage of the short
> comings in Postgres and the application.
>
> As such, I would recommend all people who offer direct access to the
> database and/or have applications which user date/time data
> types/functionality to upgrade to 7.2.2.
>
> Gavin
>
>
>
> ---------------------------(end of broadcast)---------------------------
> TIP 5: Have you checked our extensive FAQ?
>
> http://www.postgresql.org/users-lounge/docs/faq.html
>
--
Bruce Momjian | http://candle.pha.pa.us
pgman(at)candle(dot)pha(dot)pa(dot)us | (610) 359-1001
+ If your life is a hard drive, | 13 Roberts Road
+ Christ can be your backup. | Newtown Square, Pennsylvania 19073
From | Date | Subject | |
---|---|---|---|
Next Message | Marc G. Fournier | 2002-08-26 02:16:41 | Re: [GENERAL] PostgreSQL 7.2.2: Security Release |
Previous Message | Gavin Sherry | 2002-08-25 13:44:03 | Re: [GENERAL] PostgreSQL 7.2.2: Security Release |
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2002-08-25 15:02:01 | Re: CREATE INDEX .. ON table1 (field1 asc, field2 desc) |
Previous Message | Nigel J. Andrews | 2002-08-25 14:31:00 | Unwanted redirection from gborg to sourceforge? |
From | Date | Subject | |
---|---|---|---|
Next Message | Tom Lane | 2002-08-25 14:55:02 | Re: A configure.in patch check (fwd) |
Previous Message | Gavin Sherry | 2002-08-25 13:44:03 | Re: [GENERAL] PostgreSQL 7.2.2: Security Release |