PostgreSQL CVE-2014-0062 Security Bypass Vulnerability

by CIRT Team

Description: Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.

Impact: Successful exploits may allow an attacker to bypass certain security restrictions and perform unauthorized actions, which may lead to further attacks. Versions prior to PostgreSQL 9.3.3, 9.2.7, 9.1.12, 9.0.16, and 8.4.20 are vulnerable.

Mitigation: Updates are available. Please see the references or vendor advisory for more information.

Reference URL’s:

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0062
• http://www.securityfocus.com/bid/65727/info
• http://wiki.postgresql.org/wiki/20140220securityrelease
• https://www.postgresql.org/about/news/1506/
• http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html

CIRT Team

Recommended Posts

Active Exploitation of Critical F5 BIG – IP Vulnerability (CVE–2023-46747) Uncovered in Bangladesh

06 Nov 2024 - Security Advisories & Alerts

Emerging Threat_Stealer Malware (Lumma C2) Campaign with fake CAPTCHA pages

08 Oct 2024 - Security Advisories & Alerts

Detection of Fog Ransomware Footprint in Cyber Space of Bangladesh

12 Sep 2024 - Security Advisories & Alerts