The researcher should watch this video https://www.youtube.com/watch?v=866olNIzbrk
CVE-2019-9193: Not a Security Vulnerability
11–20 of 84 posts
Re: CVE-2019-9193: Not a Security Vulnerability
#12While the behavior described might be by design, I'm skeptical of any database query that involves accessing user-specified local files or executing system commands. (MySQL also has the infamous LOAD DATA INFILE query.) They look like band-aids designed for people who can't be bothered to import/export their data using standard shell commands, scripts, pipes, and database-specific dump/restore tools. These kinds of f…
Sure, but that's a different discussion. No matter how potentially dangerous some software behaviour is, if it's both intentional, and well-documented as being dangerous and intentionally so, there is no CVE.
Re: CVE-2019-9193: Not a Security Vulnerability
#13"It rather involved being on the other side of this airtight hatchway: Writing to the application directory" (2012)
Raymond Chen on "security vulnerabilities" that depend on already having superuser status.
https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=58...
Looks like Microsoft messed up the line breaks on switching to a new blog platform.
Re: CVE-2019-9193: Not a Security Vulnerability
#14While the behavior described might be by design, I'm skeptical of any database query that involves accessing user-specified local files or executing system commands. (MySQL also has the infamous LOAD DATA INFILE query.) They look like band-aids designed for people who can't be bothered to import/export their data using standard shell commands, scripts, pipes, and database-specific dump/restore tools. These kinds of f…
As mentioned in the article, this feature is disabled by default for non-superusers.
If you’re talking about a more broad “COPY TO/FROM” is evil, then I think this is a far broader discussion, and I encourage you to get a better understanding of some of the use cases.
Re: CVE-2019-9193: Not a Security Vulnerability
#15Direct link to “CVE-2019-9193: Not a Security Vulnerability” https://www.postgresql.org/about/news/1935/ Which is also currently a banner at postgresql.org titled “4th April 2019: CVE-2019-9193: Not a Security Vulnerability”
Per the links in the NVC CVE page, the reporter seems to have retracted it too. It was a bad report. To be fair, it's also a bad feature. But bad features working as intended shouldn't be "vulnerabilities".
COPY TO/FROM PROGRAM is not a bad feature. It is in fact an amazing and wonderful thing that makes ETL with Postgres much more powerful. Almost all language runtimes can spawn subprocesses. What is your rational for declaring it "bad" with no explanation?
Re: CVE-2019-9193: Not a Security Vulnerability
#16TL;DR Don't grant root to strangers, because they might do something rude with your db.
[deleted]
Re: CVE-2019-9193: Not a Security Vulnerability
#17After reading the discussion, that seems like the entirely right call. The security researchers did not seem too concerned with the feedback they got from the community prior to releasing this CVE.
Yeah, I discovered a flaw in SSH the other day, if my account on the remote server Is listed in the sudoers file I can escalate to root priviliges, as soon as I create a snazzy logo I'm going to get myself a CVE. Seriously though, security research is starting to drift into bizarro land, security contacts at companies are inundated with port-scans asking for bug bounties because there's an open port and now people ar…
starting? Raymond Chen has been blogging about bizarre vulnerability reports for almost 13 years now.
Re: CVE-2019-9193: Not a Security Vulnerability
#18Sounds the same as xp_cmdshell scenarios in past. Although worth pointing out Microsoft there did lock down things further to even disable the feature and it has to be turned on explicitly. That's possibly an improvement Postgress can do to avoid easy pivoting. Its what a less defensive security reply would include, because if hackers use it to pivot it might not look good down the road. But from a pure argument stan…
If I understand it correctly, the feature is controlled via a user permission which is not granted by default.
Re: CVE-2019-9193: Not a Security Vulnerability
#19[deleted]
Re: CVE-2019-9193: Not a Security Vulnerability
#20Sounds the same as xp_cmdshell scenarios in past. Although worth pointing out Microsoft there did lock down things further to even disable the feature and it has to be turned on explicitly. That's possibly an improvement Postgress can do to avoid easy pivoting. Its what a less defensive security reply would include, because if hackers use it to pivot it might not look good down the road. But from a pure argument stan…
Quoting Andreas Freund from the mailing list:
""" Btw, the xp_cmdshell thing the author references several times? It can be enabled via tsql if you have a privileged account.
https://docs.microsoft.com/en-us/sql/database-engine/configu...
and it allows to execute shell code (as a specified user) even when not a sysadmin: https://docs.microsoft.com/en-us/sql/relational-databases/sy... """
so no MS didn't really "lock down" the feature.