NVD

Id
55431  
Name
CVE-2007-3278  
Description
PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.  
Reject
 
CVSS Version
2  
CVSS Score
6.9  
Severity
Medium  
CVSS Base Score
6.9  
CVSS Impact Subscore
10  
CVSS Exploit Subscore
3.4  
CVSS Vector
(AV:L/AC:M/Au:N/C:C/I:C/A:C)  
Pub Date
2017-01-07  
Published
2007-06-19  
Modified Date
2011-03-07  
Seq
2007-3278  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
281673 55431 CVE-2007-3278 SSRT080006  View
281674 55431 CVE-2007-3278 oval:org.mitre.oval:def:10334  View
281675 55431 CVE-2007-3278 GLSA-200801-15  View
281676 55431 CVE-2007-3278 103197  View
281677 55431 CVE-2007-3278 200559  View
281678 55431 CVE-2007-3278 DSA-1460  View
281679 55431 CVE-2007-3278 DSA-1463  View
281680 55431 CVE-2007-3278 http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt  View
281681 55431 CVE-2007-3278 MDKSA-2007:188  View
281682 55431 CVE-2007-3278 http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf  View
281683 55431 CVE-2007-3278 RHSA-2008:0038  View
281684 55431 CVE-2007-3278 RHSA-2008:0039  View
281685 55431 CVE-2007-3278 RHSA-2008:0040  View
281686 55431 CVE-2007-3278 20070618 Re: Having Fun With PostgreSQL  View
281687 55431 CVE-2007-3278 20070616 Having Fun With PostgreSQL  View
281688 55431 CVE-2007-3278 USN-568-1  View
281689 55431 CVE-2007-3278 ADV-2008-0109  View
281690 55431 CVE-2007-3278 ADV-2008-1071  View
281691 55431 CVE-2007-3278 postgresql-dblink-sql-injection(35142)  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
52394 JVNDB-2007-001086 PostgreSQL における任意の SQL クエリを実行される脆弱性 PostgreSQL には、local trust 認証を有効にしている、および Database Link library (dblink) をインストールしている場合、127.0.0.1 からのプロキシ接続の dblink host パラメータの取り扱いに不備があり、任意のアカウントでのアクセスおよび任意の SQL クエリを実行される脆弱性が存在します。 CVE-2007-3278 26633 CVE-2007-3278 55431 9.3 http://jvndb.jvn.jp/ja/contents/2007/JVNDB-2007-001086.html 2007-06-19 2008-04-15 View