FreeBSD VuXML: Documenting security issues in FreeBSD and the FreeBSD Ports Collection

CVE-2006-0553

This CVE name corresponds to:

Entered	Topic
2006-02-18	postgresql81-server -- SET ROLE privilege escalation

The following information is adapted from the Common Vulnerabilities and Exposures (CVE) project. CVE and the CVE logo are trademarks of The MITRE Corporation. CVE content is Copyright 2005, The MITRE Corporation.

CVE-2006-0553 at cve.mitre.org

Details

Type	Candidate
Name	CVE-2006-0553
Phase	Assigned(20060205)

Description

PostgreSQL 8.1.0 through 8.1.2 allows authenticated database users to gain additional privileges via "knowledge of the backend protocol" using a crafted SET ROLE to other database users, a different vulnerability than CVE-2006-0678.

References

Source	Reference
BUGTRAQ	20060215 PostgreSQL security releases 8.1.3, 8.0.7, 7.4.12, 7.3.14
MLIST	[pgsql-announce] 20060214 Minor Releases 7.3 thru 8.1 Available to Fix Security Issue
CONFIRM	http://www.postgresql.org/docs/8.1/static/release.html#RELEASE-8-1-3
OPENPKG	OpenPKG-SA-2006.004
CERT-VN	VU#567452
BID	16649
VUPEN	ADV-2006-0605
SECTRACK	1015636
SECUNIA	18890
XF	postgresql-setrole-privilege-elevation(24718)