CVE-2012-0866: CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger… | LiveThreat CVE Feed — Verisq

Login Request a demo

Unscored severity · published Jul 18, 2012

CVE-2012-0866

CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger…

–

CVSS

3.6%

EPSS

No

On KEV

Description

CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger functions marked SECURITY DEFINER, which allows remote authenticated users to execute otherwise restricted triggers on arbitrary data by installing the trigger on an attacker-owned table.

Exploitation

Is it being used?

Exploit prediction (EPSS)3.6% · higher than 89% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

PO

PostgreSQL · PostgreSQL

8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +33 more · source: NVD

Affected product

PO

PostgreSQL

PostgreSQL

All PostgreSQL CVEs

References

https://nvd.nist.gov/vuln/detail/CVE-2012-0866

https://www.cve.org/CVERecord?id=CVE-2012-0866

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

lists.opensuse.org

http://lists.opensuse.org/opensuse-updates/2012-09/msg00060.html

http://rhn.redhat.com/errata/RHSA-2012-0677.html

http://rhn.redhat.com/errata/RHSA-2012-0678.html

http://secunia.com/advisories/49272

http://secunia.com/advisories/49273

More from PostgreSQL

9.8

PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a protocol message,…

9.8

The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly handle system-call…

9.8

Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory

9.8

postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE TRIGGER

9.8

PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to database accounts…