CVE-2009-3231

Published: Sep 17, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

Affected (12)

Products: Postgresql: Postgresql · Opensuse: Opensuse · Suse: Linux Enterprise, Linux Enterprise Server · +2 more

Show all products

Postgresql: Postgresql · Opensuse: Opensuse · Suse: Linux Enterprise, Linux Enterprise Server · Fedoraproject: Fedora · Canonical: Ubuntu Linux

1 product

1 product

2 products

Linux Enterprise Server

1 product

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Postgresql Postgresql	From 8.2 to 8.2.14
Postgresql Postgresql	From 8.3 to 8.3.8

Configuration B

4 vulnerable

Vulnerable Software	Affected Versions
Opensuse Opensuse	From 10.3 to 11.1
Suse Linux Enterprise	Version 10.0 sp2
Suse Linux Enterprise	Version 11.0
Suse Linux Enterprise Server	Version 9

Configuration C

2 vulnerable

Vulnerable Software	Affected Versions
Fedoraproject Fedora	Version 10
Fedoraproject Fedora	Version 11

Configuration D

4 vulnerable

Vulnerable Software	Affected Versions
Canonical Ubuntu Linux	Version 6.06
Canonical Ubuntu Linux	Version 8.04
Canonical Ubuntu Linux	Version 8.10
Canonical Ubuntu Linux	Version 9.04

Related CWEs

CWE-287

Improper Authentication

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

References (34)

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html

Source: cve@mitre.org

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html

Source: cve@mitre.org

Mailing List

http://marc.info/?l=bugtraq&m=134124585221119&w=2

Source: cve@mitre.org

Mailing List

http://secunia.com/advisories/36660

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/36727

Source: cve@mitre.org

Broken LinkVendor Advisory

http://secunia.com/advisories/36800

Source: cve@mitre.org

Broken Link

http://secunia.com/advisories/36837

Source: cve@mitre.org

Broken Link

http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012

Source: cve@mitre.org

Broken Link

http://www.postgresql.org/docs/8.3/static/release-8-3-8.html

Source: cve@mitre.org

Release Notes

http://www.postgresql.org/support/security.html

Source: cve@mitre.org

Broken LinkVendor Advisory

http://www.securityfocus.com/archive/1/509917/100/0/threaded

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.securityfocus.com/bid/36314

Source: cve@mitre.org

Broken LinkThird Party AdvisoryVDB Entry

http://www.ubuntu.com/usn/usn-834-1

Source: cve@mitre.org

Third Party Advisory

http://www.us.debian.org/security/2009/dsa-1900

Source: cve@mitre.org

Broken Link

https://bugzilla.redhat.com/show_bug.cgi?id=522084

Source: cve@mitre.org

Issue TrackingPatch

https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html

Source: cve@mitre.org

Mailing List

https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html

Source: cve@mitre.org

Mailing List

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html