CVE-2007-3278

Published: Jun 19, 2007Modified: Apr 23, 2026

6.9

Vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability: 3.4 / Impact: 10.0

Source: NVD

Description

PostgreSQL 8.1 and probably later versions, when local trust authentication is enabled and the Database Link library (dblink) is installed, allows remote attackers to access arbitrary accounts and execute arbitrary SQL queries via a dblink host parameter that proxies the connection from 127.0.0.1.

Affected (7)

Products: Postgresql: Postgresql · Debian: Debian Linux

1 product

1 product

Configuration A

5 vulnerable

Vulnerable Software	Affected Versions
Postgresql Postgresql	From 7.3 to 7.3.21
Postgresql Postgresql	From 7.4 to 7.4.19
Postgresql Postgresql	From 8.0 to 8.0.15
Postgresql Postgresql	From 8.1 to 8.1.11
Postgresql Postgresql	From 8.2 to 8.2.6

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 3.1
Debian Debian Linux	Version 4.0

Related CWEs

CWE-264

References (58)

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154

Source: cve@mitre.org

Third Party Advisory

http://osvdb.org/40899

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/28376

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/28437

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/28438

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/28445

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/28454

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/28477

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/28479

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/28679

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/29638

Source: cve@mitre.org

Broken Link

http://security.gentoo.org/glsa/glsa-200801-15.xml

Source: cve@mitre.org

Third Party Advisory

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1

Source: cve@mitre.org

Broken Link

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1

Source: cve@mitre.org

Broken Link

http://www.debian.org/security/2008/dsa-1460

Source: cve@mitre.org

Third Party Advisory

http://www.debian.org/security/2008/dsa-1463

Source: cve@mitre.org

Third Party Advisory

http://www.leidecker.info/pgshell/Having_Fun_With_PostgreSQL.txt

Source: cve@mitre.org

Third Party Advisory

http://www.mandriva.com/security/advisories?name=MDKSA-2007:188

Source: cve@mitre.org

Third Party Advisory

http://www.portcullis.co.uk/uplds/whitepapers/Having_Fun_With_PostgreSQL.pdf

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0038.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0039.html

Source: cve@mitre.org

Third Party Advisory

http://www.redhat.com/support/errata/RHSA-2008-0040.html

Source: cve@mitre.org

Third Party Advisory

http://www.securityfocus.com/archive/1/471541/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.securityfocus.com/archive/1/471644/100/0/threaded

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

http://www.vupen.com/english/advisories/2008/0109

Source: cve@mitre.org

Permissions Required

http://www.vupen.com/english/advisories/2008/1071/references

Source: cve@mitre.org

Permissions Required

https://exchange.xforce.ibmcloud.com/vulnerabilities/35142

Source: cve@mitre.org

Third Party AdvisoryVDB Entry

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10334

Source: cve@mitre.org

Third Party Advisory

https://usn.ubuntu.com/568-1/

Source: cve@mitre.org

Third Party Advisory

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154