NVD

Id
14818  
Name
CVE-2010-3433  
Description
The PL/perl and PL/Tcl implementations in PostgreSQL 7.4 before 7.4.30, 8.0 before 8.0.26, 8.1 before 8.1.22, 8.2 before 8.2.18, 8.3 before 8.3.12, 8.4 before 8.4.5, and 9.0 before 9.0.1 do not properly protect script execution by a different SQL user identity within the same session, which allows remote authenticated users to gain privileges via crafted script code in a SECURITY DEFINER function, as demonstrated by (1) redefining standard functions or (2) redefining operators, a different vulnerability than CVE-2010-1168, CVE-2010-1169, CVE-2010-1170, and CVE-2010-1447.  
Reject
 
CVSS Version
2  
CVSS Score
6  
Severity
Medium  
CVSS Base Score
6  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
6.8  
CVSS Vector
(AV:N/AC:M/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-18  
Published
2010-10-06  
Modified Date
2016-12-07  
Seq
2010-3433  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
81979 14818 CVE-2010-3433 http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705  View
81980 14818 CVE-2010-3433 FEDORA-2010-15954  View
81981 14818 CVE-2010-3433 FEDORA-2010-15960  View
81982 14818 CVE-2010-3433 SUSE-SR:2010:019  View
81983 14818 CVE-2010-3433 SUSE-SR:2010:020  View
81984 14818 CVE-2010-3433 SSRT100617  View
81985 14818 CVE-2010-3433 oval:org.mitre.oval:def:7291  View
81986 14818 CVE-2010-3433 DSA-2120  View
81987 14818 CVE-2010-3433 MDVSA-2010:197  View
81988 14818 CVE-2010-3433 http://www.postgresql.org/about/news.1244  View
81989 14818 CVE-2010-3433 http://www.postgresql.org/docs/9.0/static/release-9-0-1.html  View
81990 14818 CVE-2010-3433 RHSA-2010:0742  View
81991 14818 CVE-2010-3433 RHSA-2010:0908  View
81992 14818 CVE-2010-3433 43747  View
81993 14818 CVE-2010-3433 USN-1002-1  View
81994 14818 CVE-2010-3433 USN-1002-2  View
81995 14818 CVE-2010-3433 ADV-2010-3051  View
81996 14818 CVE-2010-3433 https://bugzilla.redhat.com/show_bug.cgi?id=639371  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
36364 JVNDB-2010-002144 PostgreSQL の PL/perl および PL/Tcl 実装における権限を取得される脆弱性 PostgreSQL の PL/perl および PL/Tcl 実装は、同じセッション内の異なる SQL のユーザ ID によるスクリプトの実行を適切に保護しないため、権限を取得される脆弱性が存在します。 CVE-2010-3433 46013 CVE-2010-3433 14818 6 http://jvndb.jvn.jp/ja/contents/2010/JVNDB-2010-002144.html 2010-10-04 2010-12-02 View