Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

postgresql.org

Post reply on HN
Print view View original

11–20 of 105 posts

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#11

Post by qompiler »

sgift wrote: post #6
dkulchenko wrote: post #4

So if I have no databases that start with "-", I'm not vulnerable? Didn't quite understand what they meant by that.

Just from the quote cited by octo_t I would read that you are still vulnerable: A malicious database user could craft a _connection string_ which contains a database name starting with -. There's no hint that the database has to exist on your server for this to work, so I would read it could be a complete bogus request and still damage your files.

/* Is this all it takes? */

PQconnectdb("host=127.0.0.1 dbname=-exploit user=postgres password=postgres port=5432");

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#12

Post by r4vik »

octo_t wrote: post #5

This is the main vulnerability I presume > A connection request containing a database name that begins with "-" may be crafted to damage or destroy files within a server's data directory I just. No words.

defense in depth though, users shouldn't be able to craft connection requests to begin with

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#13

Post by gingerlime »

"Heroku was given access to updated source code which patched the vulnerability at the same time as other packagers. Because Heroku was especially vulnerable, the PostgreSQL Core Team worked with them both to secure their infrastructure and to use their deployment as a test-bed for the security patches, in order to verify that the security update did not break any application functionality. Heroku has a history both of working closely with community developers, and of testing experimental features in their PostgreSQL service."

I believe all the heroku hosted postgresql servers are externally accessible and there's no way to filter access by IP.

Of course hindsight is always 20:20, but perhaps it's a good idea for heroku to consider adding some basic (optional) firewall layer to allow customers to control who can connect to the hosted db?

Disclaimer: I'm not a heroku customer. I did however consider moving our pg's over to them a little while ago.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#14

Post by mark_l_watson »

Bootvis wrote: post #8

I'm not an expert so I'll ask here: Is there an attack vector if you run PostgreSQL locally, no untrusted users are able to create connection strings and do not allow remote access? It seems to be no but I prefer to be sure ;)

I would like an answer to this, quickly, also. I am scheduled to leave on a 6 hour hike in one hour - I have time to update if I have to. I only permit localhost connections.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#15

Post by gingerlime »

Bootvis wrote: post #8

I'm not an expert so I'll ask here: Is there an attack vector if you run PostgreSQL locally, no untrusted users are able to create connection strings and do not allow remote access? It seems to be no but I prefer to be sure ;)

as far as I understand from the FAQ page, as long as connections to your PG database are blocked from external sources, you should be safe. Seems like a good idea to upgrade as soon as possible anyway though.

  > How can users protect themselves?
  > * Download the update release and update all of your servers as soon as possible.
  > * Ensure that PostgreSQL is not open to connections from untrusted networks.
  > * Audit your database users to be certain that all logins require proper credentials, and that the only logins which exist are legitimate and in current use.
EDIT: added a quote from the FAQ for clarity.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#16

Post by talkingquickly »

mark_l_watson wrote: post #14
Bootvis wrote: post #8

I'm not an expert so I'll ask here: Is there an attack vector if you run PostgreSQL locally, no untrusted users are able to create connection strings and do not allow remote access? It seems to be no but I prefer to be sure ;)

I would like an answer to this, quickly, also. I am scheduled to leave on a 6 hour hike in one hour - I have time to update if I have to. I only permit localhost connections.

From the FAQ:

Who is most at risk:

"Any system that allows unrestricted access to the PostgreSQL network port, such as users running PostgreSQL on a public cloud, is especially vulnerable. Users whose servers are only accessible on protected internal networks, or who have effective firewalling or other network access restrictions, are less vulnerable."

So looks like it's low risk but they're not willing to say no risk.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#17

Post by phillmv »

octo_t wrote: post #5

This is the main vulnerability I presume > A connection request containing a database name that begins with "-" may be crafted to damage or destroy files within a server's data directory I just. No words.

Getting this stuff right is hard. Don't be a hater.

Just because the attack vector looks simple doesn't mean the bug was obvious.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#18

Post by __alexs »

octo_t wrote: post #5

This is the main vulnerability I presume > A connection request containing a database name that begins with "-" may be crafted to damage or destroy files within a server's data directory I just. No words.

The FAQ makes no mention of this massive data loss possibility which seems a bit odd…

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#19

Post by 16s »

phillmv wrote: post #17
octo_t wrote: post #5

This is the main vulnerability I presume > A connection request containing a database name that begins with "-" may be crafted to damage or destroy files within a server's data directory I just. No words.

Getting this stuff right is hard. Don't be a hater. Just because the attack vector looks simple doesn't mean the bug was obvious.

I agree. Postgres is one of the most well thought out DBs I've ever used. They are slow to add features but when they do, they are done right with lot's of attention to detail. Everyone makes mistakes.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#20

Post by buttscicles »

gingerlime wrote: post #15
Bootvis wrote: post #8

I'm not an expert so I'll ask here: Is there an attack vector if you run PostgreSQL locally, no untrusted users are able to create connection strings and do not allow remote access? It seems to be no but I prefer to be sure ;)

as far as I understand from the FAQ page, as long as connections to your PG database are blocked from external sources, you should be safe. Seems like a good idea to upgrade as soon as possible anyway though. > How can users protect themselves? > * Download the update release and update all of your servers as soon as possible. > * Ensure that PostgreSQL is not open to connections from untrusted networks. > * Audit yo…

It doesn't specify whether pg_hba.conf is sufficient to protect against this, anybody have any word on that?
Post reply on HN