Your message dated Tue, 01 Feb 2005 20:02:24 -0500
with message-id <[EMAIL PROTECTED]>
and subject line Bug#293125: fixed in postgresql 7.4.7-1
has caused the attached Bug report to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what I am
talking about this indicates a serious mail system misconfiguration
somewhere. Please contact me immediately.)
Debian bug tracking system administrator
(administrator, Debian Bugs database)
--------------------------------------
Received: (at submit) by bugs.debian.org; 1 Feb 2005 09:44:17 +0000
>From [EMAIL PROTECTED] Tue Feb 01 01:44:17 2005
Return-path: <[EMAIL PROTECTED]>
Received: from mail.enyo.de [212.9.189.167]
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1Cvua1-0008E9-00; Tue, 01 Feb 2005 01:44:17 -0800
Received: from deneb.enyo.de ([212.9.189.171])
by albireo.enyo.de with esmtp id 1CvuZz-0001OH-WE
for [EMAIL PROTECTED]; Tue, 01 Feb 2005 10:44:16 +0100
Received: from fw by deneb.enyo.de with local (Exim 4.43)
id 1CvuZz-0001MC-Qe; Tue, 01 Feb 2005 10:44:15 +0100
Content-Type: text/plain; charset="us-ascii"
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
From: Florian Weimer <[EMAIL PROTECTED]>
To: Debian Bug Tracking System <[EMAIL PROTECTED]>
Subject: postgresql: LOAD security issue
X-Mailer: reportbug 3.5
Date: Tue, 01 Feb 2005 10:44:15 +0100
Message-Id: <[EMAIL PROTECTED]>
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-8.0 required=4.0 tests=BAYES_00,HAS_PACKAGE
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
Package: postgresql
Version: 7.4.6-7
Severity: grave
Tags: security
Justification: user security hole
Upstream has released new versions because of the LOAD security hole:
<http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php>
<http://archives.postgresql.org/pgsql-announce/2005-02/msg00000.php>
-- System Information:
Debian Release: 3.1
APT prefers unstable
APT policy: (800, 'unstable')
Architecture: i386 (i686)
Kernel: Linux 2.6.11-rc1fw
Locale: LANG=en_US.UTF-8, LC_CTYPE=en_US.UTF-8 (charmap=UTF-8)
Versions of packages postgresql depends on:
ii adduser 3.59 Add and remove users and groups
ii debconf [debconf 1.4.42 Debian configuration management sy
ii debianutils 2.11.2 Miscellaneous utilities specific t
ii libc6 2.3.2.ds1-20 GNU C Library: Shared libraries an
ii libcomerr2 1.36rc2-1 common error description library
ii libkrb53 1.3.6-1 MIT Kerberos runtime libraries
ii libpam0g 0.76-22 Pluggable Authentication Modules l
ii libperl5.8 5.8.4-5 Shared Perl library
ii libpq3 7.4.6-6 PostgreSQL C client library
ii libreadline4 4.3-15 GNU readline and history libraries
ii libssl0.9.7 0.9.7e-3 SSL shared libraries
ii mailx 1:8.1.2-0.20040524cvs-4 A simple mail user agent
pn postgresql-clien Not found.
ii procps 1:3.2.4-1 The /proc file system utilities
ii python2.3 2.3.4-19 An interactive high-level object-o
ii ucf 1.13 Update Configuration File: preserv
ii zlib1g 1:1.2.2-4 compression library - runtime
---------------------------------------
Received: (at 293125-close) by bugs.debian.org; 2 Feb 2005 01:08:13 +0000
>From [EMAIL PROTECTED] Tue Feb 01 17:08:13 2005
Return-path: <[EMAIL PROTECTED]>
Received: from newraff.debian.org [208.185.25.31] (mail)
by spohr.debian.org with esmtp (Exim 3.35 1 (Debian))
id 1Cw909-0000It-00; Tue, 01 Feb 2005 17:08:13 -0800
Received: from katie by newraff.debian.org with local (Exim 3.35 1 (Debian))
id 1Cw8uW-0005s2-00; Tue, 01 Feb 2005 20:02:24 -0500
From: Martin Pitt <[EMAIL PROTECTED]>
To: [EMAIL PROTECTED]
X-Katie: $Revision: 1.55 $
Subject: Bug#293125: fixed in postgresql 7.4.7-1
Message-Id: <[EMAIL PROTECTED]>
Sender: Archive Administrator <[EMAIL PROTECTED]>
Date: Tue, 01 Feb 2005 20:02:24 -0500
Delivered-To: [EMAIL PROTECTED]
X-Spam-Checker-Version: SpamAssassin 2.60-bugs.debian.org_2005_01_02
(1.212-2003-09-23-exp) on spohr.debian.org
X-Spam-Status: No, hits=-6.0 required=4.0 tests=BAYES_00,HAS_BUG_NUMBER
autolearn=no version=2.60-bugs.debian.org_2005_01_02
X-Spam-Level:
X-CrossAssassin-Score: 2
Source: postgresql
Source-Version: 7.4.7-1
We believe that the bug you reported is fixed in the latest version of
postgresql, which is due to be installed in the Debian FTP archive:
libecpg-dev_7.4.7-1_i386.deb
to pool/main/p/postgresql/libecpg-dev_7.4.7-1_i386.deb
libecpg4_7.4.7-1_i386.deb
to pool/main/p/postgresql/libecpg4_7.4.7-1_i386.deb
libpgtcl-dev_7.4.7-1_i386.deb
to pool/main/p/postgresql/libpgtcl-dev_7.4.7-1_i386.deb
libpgtcl_7.4.7-1_i386.deb
to pool/main/p/postgresql/libpgtcl_7.4.7-1_i386.deb
libpq3_7.4.7-1_i386.deb
to pool/main/p/postgresql/libpq3_7.4.7-1_i386.deb
postgresql-client_7.4.7-1_i386.deb
to pool/main/p/postgresql/postgresql-client_7.4.7-1_i386.deb
postgresql-contrib_7.4.7-1_i386.deb
to pool/main/p/postgresql/postgresql-contrib_7.4.7-1_i386.deb
postgresql-dev_7.4.7-1_i386.deb
to pool/main/p/postgresql/postgresql-dev_7.4.7-1_i386.deb
postgresql-doc_7.4.7-1_all.deb
to pool/main/p/postgresql/postgresql-doc_7.4.7-1_all.deb
postgresql_7.4.7-1.diff.gz
to pool/main/p/postgresql/postgresql_7.4.7-1.diff.gz
postgresql_7.4.7-1.dsc
to pool/main/p/postgresql/postgresql_7.4.7-1.dsc
postgresql_7.4.7-1_i386.deb
to pool/main/p/postgresql/postgresql_7.4.7-1_i386.deb
postgresql_7.4.7.orig.tar.gz
to pool/main/p/postgresql/postgresql_7.4.7.orig.tar.gz
A summary of the changes between this version and the previous one is
attached.
Thank you for reporting the bug, which will now be closed. If you
have further comments please address them to [EMAIL PROTECTED],
and the maintainer will reopen the bug report if appropriate.
Debian distribution maintenance software
pp.
Martin Pitt <[EMAIL PROTECTED]> (supplier of updated postgresql package)
(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing [EMAIL PROTECTED])
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
Format: 1.7
Date: Tue, 1 Feb 2005 12:23:04 +0100
Source: postgresql
Binary: postgresql-client libecpg4 libpgtcl-dev libpq3 postgresql-doc
libecpg-dev postgresql-dev postgresql libpgtcl postgresql-contrib
Architecture: source i386 all
Version: 7.4.7-1
Distribution: unstable
Urgency: high
Maintainer: Martin Pitt <[EMAIL PROTECTED]>
Changed-By: Martin Pitt <[EMAIL PROTECTED]>
Description:
libecpg-dev - development files for ECPG (Embedded PostgreSQL for C)
libecpg4 - run-time library for ECPG programs
libpgtcl - Tcl procedural language, library and front-end for PostgreSQL
libpgtcl-dev - Tcl library for PostgreSQL - development files
libpq3 - PostgreSQL C client library
postgresql - object-relational SQL database management system
postgresql-client - front-end programs for PostgreSQL
postgresql-contrib - additional facilities for PostgreSQL
postgresql-dev - development files for libpq (PostgreSQL library)
postgresql-doc - documentation for the PostgreSQL database management system
Closes: 262081 293125
Changes:
postgresql (7.4.7-1) unstable; urgency=high
.
* New upstream bug fix release. Fixes a local privilege escalation:
low-privileged users could use LOAD to load any shared library into the
PostgreSQL server; its initialisation function was then executed with the
permissions of the server. Closes: #293125
See http://archives.postgresql.org/pgsql-bugs/2005-01/msg00269.php
* Removed the following patches (now in upstream source):
- debian/patches/13frenchpo,
- debian/patches/14emptyarrays
* Applied some portability enhancements to work on GNU/Hurd and GNU/k*BSD,
thanks to Robert Millan:
- debian/startup-checks-root.sh: Use "sysctl" instead of direct /proc
access to read kernel variables.
- debian/rules: configure with --with-template=linux
Closes: #262081
Files:
5e5a253307750faf8beedbbd0d59ad6e 973 misc optional postgresql_7.4.7-1.dsc
d193c58aef02a745e8657c48038587ac 9952102 misc optional
postgresql_7.4.7.orig.tar.gz
fb4ee0a3607f1ce2417329599617978d 148925 misc optional
postgresql_7.4.7-1.diff.gz
2cb4caaa3051df8c8d6d1e1a5304ee8a 2391924 doc optional
postgresql-doc_7.4.7-1_all.deb
cb4fc592b533fbc2cb155cc9b0483f73 3792256 misc optional
postgresql_7.4.7-1_i386.deb
50a1330c384168e8dd7c0853cbbf85a5 536904 misc optional
postgresql-client_7.4.7-1_i386.deb
2daec96e18e18b02049bcab424b63a79 512102 libdevel optional
postgresql-dev_7.4.7-1_i386.deb
0a2927155f2338afdb6a0f3c7e62e98c 124126 libs optional libpq3_7.4.7-1_i386.deb
09dbbc49ae2a6146a9607727baa91ab1 93114 libs optional libecpg4_7.4.7-1_i386.deb
3ada9f418147398d5d1289e5d20471eb 204392 libdevel optional
libecpg-dev_7.4.7-1_i386.deb
e46b7d18702bf0a26faf5fe080d4d3c5 75134 libs optional libpgtcl_7.4.7-1_i386.deb
01fd0e62792e81ff1db2bd5b4146f612 52966 libdevel optional
libpgtcl-dev_7.4.7-1_i386.deb
47f8527d139425d6feeb53281f93b859 619314 misc optional
postgresql-contrib_7.4.7-1_i386.deb
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)
iD8DBQFCACCjDecnbV4Fd/IRAlrHAJ46tCv3h7x4gvr7Kqlw+o2+ewy/TgCfWPT3
QYKdTffezQUNW5cv9fOhPsU=
=ERu2
-----END PGP SIGNATURE-----
--
To UNSUBSCRIBE, email to [EMAIL PROTECTED]
with a subject of "unsubscribe". Trouble? Contact [EMAIL PROTECTED]
