1. CVE-Search
  2. CVE-2005-1410
ID CVE-2005-1410
Summary The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.
References
Vulnerable Configurations
  • cpe:2.3:a:postgresql:postgresql:7.4:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
  • cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
    cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
  • cpe:2.3:o:trustix:secure_linux:2.0:*:*:*:*:*:*:*
    cpe:2.3:o:trustix:secure_linux:2.0:*:*:*:*:*:*:*
CVSS
Base: 2.1 (as of 19-10-2018 - 15:31)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
LOCAL LOW NONE
Impact
ConfidentialityIntegrityAvailability
NONE NONE PARTIAL
cvss-vector via4 AV:L/AC:L/Au:N/C:N/I:N/A:P
oval via4
  • accepted 2005-08-18T07:37:00.000-04:00
    class vulnerability
    contributors
    name Jay Beale
    organization Bastille Linux
    description The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.
    family unix
    id oval:org.mitre.oval:def:1086
    status accepted
    submitted 2005-06-27T12:00:00.000-04:00
    title PostgreSQL tsearch2 "internal" Functions Vulnerability
    version 4
  • accepted 2013-04-29T04:18:53.144-04:00
    class vulnerability
    contributors
    • name Aharon Chernin
      organization SCAP.com, LLC
    • name Dragos Prisaca
      organization G2, Inc.
    definition_extensions
    • comment The operating system installed on the system is Red Hat Enterprise Linux 3
      oval oval:org.mitre.oval:def:11782
    • comment CentOS Linux 3.x
      oval oval:org.mitre.oval:def:16651
    • comment The operating system installed on the system is Red Hat Enterprise Linux 4
      oval oval:org.mitre.oval:def:11831
    • comment CentOS Linux 4.x
      oval oval:org.mitre.oval:def:16636
    • comment Oracle Linux 4.x
      oval oval:org.mitre.oval:def:15990
    description The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.
    family unix
    id oval:org.mitre.oval:def:9343
    status accepted
    submitted 2010-07-09T03:56:16-04:00
    title The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.
    version 29
redhat via4
advisories
rhsa
id RHSA-2005:433
rpms
  • postgresql-0:7.4.8-1.RHEL4.1
  • postgresql-contrib-0:7.4.8-1.RHEL4.1
  • postgresql-debuginfo-0:7.4.8-1.RHEL4.1
  • postgresql-devel-0:7.4.8-1.RHEL4.1
  • postgresql-docs-0:7.4.8-1.RHEL4.1
  • postgresql-jdbc-0:7.4.8-1.RHEL4.1
  • postgresql-libs-0:7.4.8-1.RHEL4.1
  • postgresql-pl-0:7.4.8-1.RHEL4.1
  • postgresql-python-0:7.4.8-1.RHEL4.1
  • postgresql-server-0:7.4.8-1.RHEL4.1
  • postgresql-tcl-0:7.4.8-1.RHEL4.1
  • postgresql-test-0:7.4.8-1.RHEL4.1
  • rh-postgresql-0:7.3.10-1
  • rh-postgresql-contrib-0:7.3.10-1
  • rh-postgresql-debuginfo-0:7.3.10-1
  • rh-postgresql-devel-0:7.3.10-1
  • rh-postgresql-docs-0:7.3.10-1
  • rh-postgresql-jdbc-0:7.3.10-1
  • rh-postgresql-libs-0:7.3.10-1
  • rh-postgresql-pl-0:7.3.10-1
  • rh-postgresql-python-0:7.3.10-1
  • rh-postgresql-server-0:7.3.10-1
  • rh-postgresql-tcl-0:7.3.10-1
  • rh-postgresql-test-0:7.3.10-1
refmap via4
bid 13475
confirm http://www.postgresql.org/about/news.315
fedora FLSA-2006:157366
mlist [pgsql-announce] 20050502 IMPORTANT: two new PostgreSQL security problems found
suse SUSE-SA:2005:036
vupen ADV-2005-0453
Last major update 19-10-2018 - 15:31
Published 03-05-2005 - 04:00
Last modified 19-10-2018 - 15:31
Back to Top