Local Denial of Service Vulnerability in PostgreSQL Common Package
Summary
CVE-2017-8806: The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other packages related to Debian and Ubuntu), handle... Affects postgresql-common versions < 188. Fixed in 188. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The postgresql-common package is a crucial component in Debian-based systems, providing essential utilities for managing PostgreSQL clusters. It includes scripts like pg_ctlcluster, pg_createcluster, and pg_upgradecluster, which facilitate the creation, control, and upgrade of PostgreSQL clusters. However, prior to version 181+deb9u1, these scripts were found to handle symbolic links insecurely, exposing the system to potential local denial of service attacks.
Vulnerability Detail
The vulnerability, identified as CVE-2017-8806, arises from the insecure handling of symbolic links in the Debian postgresql-common package. This flaw allows a local attacker to exploit the scripts to overwrite arbitrary files, potentially leading to a denial of service. The vulnerability is particularly concerning as it can be executed by any local user, making it a low-barrier attack vector. The CVSS score for this vulnerability is 5.5, indicating a moderate level of severity.
How To Fix
Minimum fixed version
188
This is the first release that contains the fix.
sudo apt-get install --only-upgrade postgresql-commonTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can restrict access to the affected scripts or monitor for unauthorized changes to critical files. However, this is not a permanent solution and upgrading the package is strongly recommended.
Conclusion
CVE-2017-8806 represents a significant local denial of service vulnerability in the postgresql-common package, affecting Debian-based systems. Users are strongly advised to upgrade to the latest version to mitigate risks associated with this vulnerability. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for postgresql-common →
FAQ
CVE-2017-8806 is a vulnerability in the postgresql-common package that allows local attackers to exploit insecure handling of symbolic links, potentially leading to denial of service.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Simply upload your manifest file or use the Vulert playground to check for vulnerabilities without signup.
The primary impact is a local denial of service, where an attacker could overwrite critical files, disrupting PostgreSQL services and affecting system stability.
While restricting access to the affected scripts can help, it is not a foolproof solution. The best course of action is to upgrade to the fixed version of the package.
The CVSS score for CVE-2017-8806 is 5.5, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for postgresql-common.
