レッドハット | オープンソース・カンパニー

Account Links: RHN登録方法 | RHN登録 | RHNログイン

サポート > セキュリティー&アップデート/ERRATA

PostgreSQLパッケージのアップデート

アドバイスID:	RHSA-2003:313-10
最終更新日:	2003-11-13
影響のあるプロダクト:	Red Hat Linux 7.2 Red Hat Linux 7.3 Red Hat Linux 8.0 Red Hat Linux 9
CVEs (cve.mitre.org):	CAN-2003-0901

セキュリティ・アドバイス

概要:

Updated PostgreSQL packages that correct a buffer overflow in the to_ascii
routines are now available.

PostgreSQL is an advanced Object-Relational database management system
(DBMS).

Two bugs that can lead to buffer overflows have been found in the
PostgreSQL abstract data type to ASCII conversion routines. A remote
attacker who is able to influence the data passed to the to_ascii functions
may be able to execute arbitrary code in the context of the PostgreSQL
server. These issues affect PostgreSQL 7.2.x, and 7.3.x before 7.3.4.
The Common Vulnerabilities and Exposures project (cve.mitre.org)
has assigned the name CAN-2003-0901 to these issues.

In addition, a bug that can lead to leaks has been found in the string to
timestamp abstract data type conversion routine. If the input string to
the to_timestamp() routine is shorter than what the template string is
expecting, the routine will run off the end of the input string, resulting
in a leak of previous timestamp behavior and unstable behavior.

Users of PostgreSQL are advised to upgrade to these erratum packages, which
contain backported patches that correct these issues.

アップデート・パッケージ:

Red Hat Linux 7.2

SRPMS:
postgresql-7.1.3-5.72.src.rpm [ via FTP ] [ via HTTP ]	`3b9e2ff8e10ee73235eee4f9878b3e2c`

i386:
postgresql-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`7c3a5d6ca1f7f2dd8e72f5b6a8f1f08e`
postgresql-contrib-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`199e0b350daddc1c5b0a6863a0d594e4`
postgresql-devel-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`f598ffaa61d0658bc7a014f726c27eb4`
postgresql-docs-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`76b24489acbefa1d68a85334e9dc75aa`
postgresql-jdbc-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`a7fbf57b5239a0f0dc1f2090eb9986c4`
postgresql-libs-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`8a0b4bc8cf4a10acaafd77ac07487841`
postgresql-odbc-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`f53828955915f3f85e4bdd9b5ff13100`
postgresql-perl-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`2175a2b30a15ba0fd704f456e89bf620`
postgresql-python-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`8daab695f8f792ebc9b6e1f7bb9e4b3e`
postgresql-server-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`d6dcd736623928aa3bc0c86774fd677e`
postgresql-tcl-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`0e91e4b7df893387076d854f578899eb`
postgresql-tk-7.1.3-5.72.i386.rpm [ via FTP ] [ via HTTP ]	`d221da70f77bcfde3e45db2f5031963f`

ia64:
postgresql-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`a08d75e1e6822ad15ad013c85e6120c7`
postgresql-contrib-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`7e28d5be8e0bd0d818165bec29ada464`
postgresql-devel-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`449ecf2e6e4366da0c40ea19cbec9d44`
postgresql-docs-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`870a3375a086024dbb39f9045d4a8e5d`
postgresql-jdbc-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`dca82ba0c32af1eeba14d6dd2c5900f1`
postgresql-libs-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`7011e7f2a8dc5783a85fb4aac8021318`
postgresql-odbc-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`c29108c4f8aa08c10f3abbda7da44e2a`
postgresql-perl-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`a1de988920b4f4168cf3e5f6e1948d33`
postgresql-python-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`b76c3fdd7fd75022090ab2b3e34f89c5`
postgresql-server-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`708e6aee14651d95c4545dca0ddb019b`
postgresql-tcl-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`c6534b3683ae56c26f2dd7cddcf18850`
postgresql-tk-7.1.3-5.72.ia64.rpm [ via FTP ] [ via HTTP ]	`955f17c80ebfcca0d47a51b4b673cc49`

Red Hat Linux 7.3

SRPMS:
postgresql-7.2.4-5.73.src.rpm [ via FTP ] [ via HTTP ]	`14ea1e277128556a0917ff80f0100c41`

i386:
postgresql-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`abd2341cc0b8f427f0f84c8ce6f7710e`
postgresql-contrib-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`602a38f5dbd6b3a6f28c24316302d054`
postgresql-devel-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`d6bcea09edb4a5f2b4e359aec148fac6`
postgresql-docs-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`3676c768fd98d65afaa36cf87a425f52`
postgresql-jdbc-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`7fd081b51a0f58d4fe0cb0c9ab9f75cf`
postgresql-libs-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`18783f38869468526aa6b08f3a83be20`
postgresql-odbc-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`0a8755748029b7a00cd72fdd983cd393`
postgresql-perl-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`838689dc075829db6daa31008bcf023f`
postgresql-python-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`f9ba380c5ffb8d60ea3a3a56a058a026`
postgresql-server-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`f7c597c8a1e570b05cc2e96aaff36976`
postgresql-tcl-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`5953fa3fb0b5c9b60995fea6f4d7a0bc`
postgresql-test-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`9ed994f7a7bb893ad7231e9f061d6096`
postgresql-tk-7.2.4-5.73.i386.rpm [ via FTP ] [ via HTTP ]	`eecaf538b82017ef9d9477e705dfe43e`

Red Hat Linux 8.0

SRPMS:
postgresql-7.2.4-5.80.src.rpm [ via FTP ] [ via HTTP ]	`41ddf2310b09192ece222c63db493bed`

i386:
postgresql-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`10db84d5b83030a2e067863409c1483b`
postgresql-contrib-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`355456728b812be50b511ac5ae5463cc`
postgresql-devel-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`2030c7cbaf2f6d9e7f8e418d85a5ae60`
postgresql-docs-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`9d6573e6a1a28b3b49bcda3623bef83c`
postgresql-jdbc-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`aba014dc312cb5f7456d9b95127d9c2d`
postgresql-libs-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`ef7265999840169355faa8e1154d589c`
postgresql-odbc-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`10f6deacdcf4a8a0c0c033b339dd303f`
postgresql-perl-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`10266423863102563567bbc0a938d513`
postgresql-python-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`6918680b05f07654ca75996555df4d1d`
postgresql-server-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`f0fbf27d2057e2eb89fb50dd8ec2f98f`
postgresql-tcl-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`1a55f8dd7106b2986cad8a0a1160d6af`
postgresql-test-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`cd10624a6f4a4d23e9d4d689972bb139`
postgresql-tk-7.2.4-5.80.i386.rpm [ via FTP ] [ via HTTP ]	`acfcdc841d428c6546f5394906a8f488`

Red Hat Linux 9

SRPMS:
postgresql-7.3.4-3.rhl9.src.rpm [ via FTP ] [ via HTTP ]	`ea813d6b53f8d59a68409c6ef567be2f`
postgresql72-1-4.rhl9.src.rpm [ via FTP ] [ via HTTP ]	`9fce9c3b0b03ff17d7c4e07adcd5e586`

i386:
postgresql-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`a04d50e0d624f303757838666c330694`
postgresql-contrib-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`5ea368b9969bc8398304e30565ff9eea`
postgresql-devel-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`714c16b8231b455751313a39adf62551`
postgresql-docs-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`4abc44081cc8a7b3990ac56381d05695`
postgresql-jdbc-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`8f74c8789290e339f978dfdd2ca31e98`
postgresql-libs-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`f466ae466664eb36444660405d6d0356`
postgresql-pl-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`a1408c200bbe537636cb220c675f9e00`
postgresql-python-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`f835b6362b70f5feda9badb3658f32d2`
postgresql-server-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`8295e804046d6817c59eccdfa69bb44b`
postgresql-tcl-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`8cf2d9dc83d75423dade021d6f791722`
postgresql-test-7.3.4-3.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`514ebe0beda8da4446fda4cb4b221bbe`
postgresql72-libs-1-4.rhl9.i386.rpm [ via FTP ] [ via HTTP ]	`bbfb1a97b62ecb8f8f653c3b1bff5d65`

解決法:

このアップデートを適用する前に、システムに関連するリリース済の errata が適用済であることをご確認ください。
それぞれのアーキテクチャで全てのRPMをアップデートするには、以下のコマンドを実行してください：

rpm -Fvh [filename]

[filename] は、アップデートしたいRPMのファイル名です。現在インストールされているパッケージのみ、アップグレードされます。現在いるディレクトリにインストールしたいRPM *しか* 無い場合には、ワイルドカード (*.rpm) も使うことができます。
このアップデートは、Red Hat Network 経由でも行なえます。アップデートを適用する非常に簡便な方法です。Red hat Network をご利用になるには、以下のコマンドで、アップデートエージェントを起動してください。

up2date

このコマンドで、システムに適切なRPMをアップグレードする対話形式のプロセスを起動します。

バグジラ: (詳細は、こちらbugzilla[英語]を御覧ください。)

108079 - CAN-2003-0901 PostgreSQL To_Ascii() Buffer Overflow Vulnerability
109068 - to_timestamp not stable if date string shorter than template

参照:

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CAN-2003-0901
http://www.securityfocus.com/bid/8741
http://archives.postgresql.org/pgsql-bugs/2003-09/msg00014.php

ここに在るパッケージはセキュリティの為、 Red Hat, Inc. によって、 GPG 認証されています。キーは以下から利用可能になっています:
http://www.redhat.com/about/contact.html

各パッケージを確認するには次のコマンドをご利用ください: rpm --checksig filename
各パッケージが壊れていないか、もしくは改ざんされていないかを確認するには、以下のコマンドで MD5 チェックサムをお調べください: rpm --checksig --nogpg filename
注意: GnuPG キーをチェックするためには、RPM 3.0 以上が必要です。

メインリンク:

Links for this section: