NVD

Id
58595  
Name
CVE-2007-6600  
Description
PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.  
Reject
 
CVSS Version
2  
CVSS Score
6.5  
Severity
Medium  
CVSS Base Score
6.5  
CVSS Impact Subscore
6.4  
CVSS Exploit Subscore
8  
CVSS Vector
(AV:N/AC:L/Au:S/C:P/I:P/A:P)  
Pub Date
2017-01-07  
Published
2008-01-09  
Modified Date
2011-03-07  
Seq
2007-6600  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
300610 58595 CVE-2007-6600 SSRT080006  View
300611 58595 CVE-2007-6600 SUSE-SA:2008:005  View
300612 58595 CVE-2007-6600 oval:org.mitre.oval:def:10493  View
300613 58595 CVE-2007-6600 GLSA-200801-15  View
300614 58595 CVE-2007-6600 1019157  View
300615 58595 CVE-2007-6600 103197  View
300616 58595 CVE-2007-6600 200559  View
300617 58595 CVE-2007-6600 DSA-1460  View
300618 58595 CVE-2007-6600 DSA-1463  View
300619 58595 CVE-2007-6600 MDVSA-2008:004  View
300620 58595 CVE-2007-6600 http://www.postgresql.org/about/news.905  View
300621 58595 CVE-2007-6600 RHSA-2008:0038  View
300622 58595 CVE-2007-6600 RHSA-2008:0039  View
300623 58595 CVE-2007-6600 RHSA-2008:0040  View
300624 58595 CVE-2007-6600 20080107 PostgreSQL 2007-01-07 Cumulative Security Release  View
300625 58595 CVE-2007-6600 20080115 rPSA-2008-0016-1 postgresql postgresql-server  View
300626 58595 CVE-2007-6600 27163  View
300627 58595 CVE-2007-6600 USN-568-1  View
300628 58595 CVE-2007-6600 ADV-2008-0061  View
300629 58595 CVE-2007-6600 ADV-2008-0109  View
300630 58595 CVE-2007-6600 ADV-2008-1071  View
300631 58595 CVE-2007-6600 postgresql-indexfunctions-priv-escalation(39496)  View
300632 58595 CVE-2007-6600 https://issues.rpath.com/browse/RPL-1768  View
300633 58595 CVE-2007-6600 FEDORA-2008-0478  View
300634 58595 CVE-2007-6600 FEDORA-2008-0552  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
45694 JVNDB-2008-001004 PostgreSQL の index() 関数における権限昇格の脆弱性 PostgreSQL には、index() 関数内の VACUUM および ANALYZE オペレーションの権限をテーブル所有者の権限ではなく、スーパーユーザ権限を使用する、および index() 関数内に SET ROLE および SET SESSION AUTHORIZATION を定義することが可能な脆弱性が存在します。 CVE-2007-6600 29955 CVE-2007-6600 58595 5.5 http://jvndb.jvn.jp/ja/contents/2008/JVNDB-2008-001004.html 2008-01-06 2009-12-18 View