CVE-2007-2138

원문 설명

Untrusted search path vulnerability in PostgreSQL before 7.3.19, 7.4.x before 7.4.17, 8.0.x before 8.0.13, 8.1.x before 8.1.9, and 8.2.x before 8.2.4 allows remote authenticated users, when permitted to call a SECURITY DEFINER function, to gain the privileges of the function owner, related to "search_path settings."

영향받는 소프트웨어

• PostgreSQL ≥ 8.2 < 8.2.4≥ 8.1 < 8.1.9≥ 7.4 < 7.4.17< 7.3.19≥ 8.0 < 8.0.13 수정 버전: 8.2.4, 8.1.9, 7.4.17, 7.3.19 정확 일치

상세

공개일

2007-04-25

최종 수정

2024-08-07

CVSS 벡터

AV:N/AC:M/Au:S/C:P/I:P/A:P

참고 자료

• cve.org/CVE-2007-2138
• nvd.nist.gov/vuln/detail/CVE-2007-2138
• secunia.com/advisories/25334
• secunia.com/advisories/25717
• www.trustix.org/errata/2007/0015/
• www.postgresql.org/about/news.791
• secunia.com/advisories/25058
• security.gentoo.org/glsa/glsa-200705-12.xml
• www.mandriva.com/security/advisories?name=MDKSA-2007:094
• issues.rpath.com/browse/RPL-1292
• secunia.com/advisories/24999
• secunia.com/advisories/25037
• secunia.com/advisories/24989
• www.securityfocus.com/bid/23618