CVE-2007-6600

Published: Jan 9, 2008Modified: Apr 23, 2026

6.5

Vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Exploitability: 8.0 / Impact: 6.4

Source: NVD

Description

PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.

Affected (70)

Products: Postgresql: Postgresql

Postgresql

1 product

Postgresql

Configuration A

70 vulnerable

Vulnerable Software	Affected Versions
Postgresql Postgresql	Version 7.3.10
Postgresql Postgresql	Version 7.3.11
Postgresql Postgresql	Version 7.3.12
Postgresql Postgresql	Version 7.3.13
Postgresql Postgresql	Version 7.3.14
Postgresql Postgresql	Version 7.3.15
Postgresql Postgresql	Version 7.3.16
Postgresql Postgresql	Version 7.3.17
Postgresql Postgresql	Version 7.3.18
Postgresql Postgresql	Version 7.3.19
Postgresql Postgresql	Version 7.3.1
Postgresql Postgresql	Version 7.3.2
Postgresql Postgresql	Version 7.3.3
Postgresql Postgresql	Version 7.3.4
Postgresql Postgresql	Version 7.3.5
Postgresql Postgresql	Version 7.3.6
Postgresql Postgresql	Version 7.3.7
Postgresql Postgresql	Version 7.3.8
Postgresql Postgresql	Version 7.3.9
Postgresql Postgresql	Version 7.3
Postgresql Postgresql	Version 7.4.10
Postgresql Postgresql	Version 7.4.11
Postgresql Postgresql	Version 7.4.12
Postgresql Postgresql	Version 7.4.13
Postgresql Postgresql	Version 7.4.14
Postgresql Postgresql	Version 7.4.16
Postgresql Postgresql	Version 7.4.17
Postgresql Postgresql	Version 7.4.18
Postgresql Postgresql	Version 7.4.1
Postgresql Postgresql	Version 7.4.2
Postgresql Postgresql	Version 7.4.3
Postgresql Postgresql	Version 7.4.4
Postgresql Postgresql	Version 7.4.5
Postgresql Postgresql	Version 7.4.6
Postgresql Postgresql	Version 7.4.7
Postgresql Postgresql	Version 7.4.8
Postgresql Postgresql	Version 7.4.9
Postgresql Postgresql	Version 7.4
Postgresql Postgresql	Version 8.0.0
Postgresql Postgresql	Version 8.0.10
Postgresql Postgresql	Version 8.0.11
Postgresql Postgresql	Version 8.0.12
Postgresql Postgresql	Version 8.0.13
Postgresql Postgresql	Version 8.0.14
Postgresql Postgresql	Version 8.0.1
Postgresql Postgresql	Version 8.0.2
Postgresql Postgresql	Version 8.0.3
Postgresql Postgresql	Version 8.0.4
Postgresql Postgresql	Version 8.0.5
Postgresql Postgresql	Version 8.0.6
Postgresql Postgresql	Version 8.0.7
Postgresql Postgresql	Version 8.0.8
Postgresql Postgresql	Version 8.0.9
Postgresql Postgresql	Version 8.0
Postgresql Postgresql	Version 8.1.10
Postgresql Postgresql	Version 8.1.1
Postgresql Postgresql	Version 8.1.2
Postgresql Postgresql	Version 8.1.3
Postgresql Postgresql	Version 8.1.4
Postgresql Postgresql	Version 8.1.5
Postgresql Postgresql	Version 8.1.6
Postgresql Postgresql	Version 8.1.7
Postgresql Postgresql	Version 8.1.8
Postgresql Postgresql	Version 8.1.9
Postgresql Postgresql	Version 8.2.1
Postgresql Postgresql	Version 8.2.2
Postgresql Postgresql	Version 8.2.3
Postgresql Postgresql	Version 8.2.4
Postgresql Postgresql	Version 8.2.5
Postgresql Postgresql	Version 8.2

Related CWEs

CWE-264

References (76)

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154

Source: cve@mitre.org

http://lists.opensuse.org/opensuse-security-announce/2008-02/msg00000.html

Source: cve@mitre.org

http://secunia.com/advisories/28359

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28376

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28437

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28438

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28445

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28454

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28455

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28464

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28477

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28479

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28679

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/28698

Source: cve@mitre.org

Vendor Advisory

http://secunia.com/advisories/29638

Source: cve@mitre.org

Vendor Advisory

http://security.gentoo.org/glsa/glsa-200801-15.xml

Source: cve@mitre.org

http://securitytracker.com/id?1019157

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-26-103197-1

Source: cve@mitre.org

http://sunsolve.sun.com/search/document.do?assetkey=1-66-200559-1

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1460

Source: cve@mitre.org

http://www.debian.org/security/2008/dsa-1463

Source: cve@mitre.org

http://www.mandriva.com/security/advisories?name=MDVSA-2008:004

Source: cve@mitre.org

http://www.postgresql.org/about/news.905

Source: cve@mitre.org

PatchVendor Advisory

http://www.redhat.com/support/errata/RHSA-2008-0038.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0039.html

Source: cve@mitre.org

http://www.redhat.com/support/errata/RHSA-2008-0040.html

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/485864/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/archive/1/486407/100/0/threaded

Source: cve@mitre.org

http://www.securityfocus.com/bid/27163

Source: cve@mitre.org

Patch

http://www.vupen.com/english/advisories/2008/0061

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/0109

Source: cve@mitre.org

http://www.vupen.com/english/advisories/2008/1071/references

Source: cve@mitre.org

https://exchange.xforce.ibmcloud.com/vulnerabilities/39496

Source: cve@mitre.org

https://issues.rpath.com/browse/RPL-1768

Source: cve@mitre.org

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10493

Source: cve@mitre.org

https://usn.ubuntu.com/568-1/

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00397.html

Source: cve@mitre.org

https://www.redhat.com/archives/fedora-package-announce/2008-January/msg00469.html

Source: cve@mitre.org

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c01420154