Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2019-9193: Not a Security Vulnerability

postgresql.org

Post reply on HN
Print view View original

21–30 of 84 posts

Re: CVE-2019-9193: Not a Security Vulnerability

#21

Post by kerng »

jarfil wrote: post #18
kerng wrote: post #4

Sounds the same as xp_cmdshell scenarios in past. Although worth pointing out Microsoft there did lock down things further to even disable the feature and it has to be turned on explicitly. That's possibly an improvement Postgress can do to avoid easy pivoting. Its what a less defensive security reply would include, because if hackers use it to pivot it might not look good down the road. But from a pure argument stan…

If I understand it correctly, the feature is controlled via a user permission which is not granted by default.

If that is correct, then it's really a non issue I'd say.

Re: CVE-2019-9193: Not a Security Vulnerability

#23

Post by Derek_MK »

I kinda went back and forth on this. The initial comments here made me think that this was basically the reporter saying "person with su can do su things".

Then I looked at the PostgreSQL statement, which said that the report claimed that users with a read-access role could do the su things, and they said that the claim was not true.

And then I looked at the actual report, which stated that you have to have the read-access role, and the execute-access role (or su).

So, what it seems like is that both parties didn't represent the actual situation well, but the root (ha) issue was that it was reported as "IF YOU HAVE READ ACCESS (and execute access) THEN YOU CAN EXECUTE ARBITRARY CODE!!11!!!"

Re: CVE-2019-9193: Not a Security Vulnerability

#24

Post by [deleted] »

michelpp wrote: post #20
kerng wrote: post #4

Sounds the same as xp_cmdshell scenarios in past. Although worth pointing out Microsoft there did lock down things further to even disable the feature and it has to be turned on explicitly. That's possibly an improvement Postgress can do to avoid easy pivoting. Its what a less defensive security reply would include, because if hackers use it to pivot it might not look good down the road. But from a pure argument stan…

Quoting Andreas Freund from the mailing list: """ Btw, the xp_cmdshell thing the author references several times? It can be enabled via tsql if you have a privileged account. https://docs.microsoft.com/en-us/sql/database-engine/configu... and it allows to execute shell code (as a specified user) even when not a sysadmin: https://docs.microsoft.com/en-us/sql/relational-databases/sy... """ so no MS didn't really "lock…

[deleted]

Re: CVE-2019-9193: Not a Security Vulnerability

#25

Post by tipsysquid »

Hello71 wrote: post #17
mutagen wrote: post #8

Earlier quoted context omitted.

Yeah, I discovered a flaw in SSH the other day, if my account on the remote server Is listed in the sudoers file I can escalate to root priviliges, as soon as I create a snazzy logo I'm going to get myself a CVE. Seriously though, security research is starting to drift into bizarro land, security contacts at companies are inundated with port-scans asking for bug bounties because there's an open port and now people ar…

starting? Raymond Chen has been blogging about bizarre vulnerability reports for almost 13 years now.

I assume you mean this Raymond Chen of Microsoft[0]

[0] https://devblogs.microsoft.com/oldnewthing/author/oldnewthin...

Re: CVE-2019-9193: Not a Security Vulnerability

#26

Post by ajross »

michelpp wrote: post #15
ajross wrote: post #10

Earlier quoted context omitted.

Per the links in the NVC CVE page, the reporter seems to have retracted it too. It was a bad report. To be fair, it's also a bad feature. But bad features working as intended shouldn't be "vulnerabilities".

COPY TO/FROM PROGRAM is not a bad feature. It is in fact an amazing and wonderful thing that makes ETL with Postgres much more powerful. Almost all language runtimes can spawn subprocesses. What is your rational for declaring it "bad" with no explanation?

Sigh. We literally went through all this with SQL Server's xp_cmdshell feature already. All the same flame wars apply, I don't have the energy to argue it all again.

The community consensus was the MS should make this thing disabled by default, and they did. Postgres should too.

Re: CVE-2019-9193: Not a Security Vulnerability

#27

Post by jeffdavis »

kijin wrote: post #9

While the behavior described might be by design, I'm skeptical of any database query that involves accessing user-specified local files or executing system commands. (MySQL also has the infamous LOAD DATA INFILE query.) They look like band-aids designed for people who can't be bothered to import/export their data using standard shell commands, scripts, pipes, and database-specific dump/restore tools. These kinds of f…

It's not a "query" and can't be executed by normal users.

It's a command, and it's closer to other commands that do similar things, like loading a plugin (i.e. a ".so" file).

Re: CVE-2019-9193: Not a Security Vulnerability

#28

Post by imtringued »

mixologist wrote: post #22

If this is CVE, what is Docker then? :) Anyone with privileges to run docker image is basically root on your host.

This is why you should never add your user to the docker group. Just use `sudo docker` or put your docker commands in a script that can only be edited by root and execute the script via sudo with NOPASSWD.

Re: CVE-2019-9193: Not a Security Vulnerability

#29

Post by veryworried »

michelpp wrote: post #15
ajross wrote: post #10

Earlier quoted context omitted.

Per the links in the NVC CVE page, the reporter seems to have retracted it too. It was a bad report. To be fair, it's also a bad feature. But bad features working as intended shouldn't be "vulnerabilities".

COPY TO/FROM PROGRAM is not a bad feature. It is in fact an amazing and wonderful thing that makes ETL with Postgres much more powerful. Almost all language runtimes can spawn subprocesses. What is your rational for declaring it "bad" with no explanation?

There is no rational, people who simply don't understand or use a certain feature are more likely to write it off as a bad or useless feature. Pay them no mind.

COPY TO/FROM PROGRAM has been valuable for our data warehousing operations.

Re: CVE-2019-9193: Not a Security Vulnerability

#30

Post by Hello71 »

Derek_MK wrote: post #23

I kinda went back and forth on this. The initial comments here made me think that this was basically the reporter saying "person with su can do su things". Then I looked at the PostgreSQL statement, which said that the report claimed that users with a read-access role could do the su things, and they said that the claim was not true. And then I looked at the actual report, which stated that you have to have the read-…

allegedly, the reporters only edited their article after publication and widespread criticism.
Post reply on HN