DB: PostgreSQL Database Datetime Buffer Overflow 1

A code execution vulnerability has been found in PostgreSQL database server. The vulnerability is due to a stack buffer overflow when handling the Datetime string. A remote attacker can exploit the vulnerability by sending a malicious request to the target server. Successful exploitation could cause a stack buffer overflow resulting in code execution in the context of the the affected service. Unsuccessful attacks can crash the target service process to cause a denial of service condition.

Extended Description

Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to cause a denial of service (crash) or possibly execute arbitrary code via vectors related to an incorrect MAXDATELEN constant and datetime values involving (1) intervals, (2) timestamps, or (3) timezones, a different vulnerability than CVE-2014-0065.

Affected Products

Postgresql postgresql

References

CVE: CVE-2014-0063

Short Name

DB:POSTGRESQL:DATETIME-BO-1

Severity

Major

Recommended

False

Recommended Action

Drop

DB: PostgreSQL Database Datetime Buffer Overflow 1

Extended Description

Affected Products

References

Found a potential security threat?