PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released • Hacker News Board

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#81

Post by gingerlime » Thu, Apr 04, 2013, 4:54 PM UTC

craigkerstiens wrote: post #58

gingerlime wrote: post #49

Earlier quoted context omitted.

yes, when I did my little research for hosted PG, heroku was pretty much the only viable option. That said, I did come across some difficulties running `rake spec` against the heroku hosted db (since you can't drop the database, only individual tables). This was giving me some (unrelated) headache. Another thing I was really hoping for but couldn't find with heroku, was being able to do a point-in-time-restores via t…

Product manager of Heroku Postgres here; if you specifically need this functionality around point in time restores you should reach out to us. Would love to hear more around the use cases behind it.

Thanks Craig. I might do that, but I think we're too small fish for any kind of a bespoke solution. Given that you guys came up with WAL-E, I was secretly hoping this was somehow baked-into some magical heroku interface already...

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#82

Post by ashray » Thu, Apr 04, 2013, 4:56 PM UTC

danielweber wrote: post #75

ashray wrote: post #44

Earlier quoted context omitted.

I'm really happy that the PostgreSQL team was able to fix this so quickly and it does appear to be a massive security issue. However, on the flip side, in 13+ years of web development work, I've never really seen a database name beginning with "-".

Can someone follow up on this? Do you need the db name to already begin with "-" to exploit this? EDIT : No, the problem is in parsing, not the existing names: https://news.ycombinator.com/item?id=5492508

Thanks for clearing that up. I read the commit notes but it wasn't 100% clear and I was quite sure there's more to it considering this was all so hush-hush!

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#83

Post by jonknee » Thu, Apr 04, 2013, 5:13 PM UTC

ceejayoz wrote: post #46

ashray wrote: post #44

Earlier quoted context omitted.

I'm really happy that the PostgreSQL team was able to fix this so quickly and it does appear to be a massive security issue. However, on the flip side, in 13+ years of web development work, I've never really seen a database name beginning with "-".

I don't think you have to have a database starting with - for the bug to work.

No, but thankfully you do need postgres to be accessible remotely.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#84

Post by jeltz » Thu, Apr 04, 2013, 5:16 PM UTC

__alexs wrote: post #60

jeltz wrote: post #55

Earlier quoted context omitted.

The exploit does not actually destroy the files. It allows appending data to the files making the server crash. The file could be recovered by simply removing the junk data added to it. From the FAQ: > Persistent Denial of Service: an unauthenticated attacker may use this vulnerability to cause PostgreSQL error messages to be appended to targeted files in the PostgreSQL data directory on the server. Files corrupted i…

You actually expect most users to figure that out? Especially if corrupted with stuff that looks vaguely like regular postgres data...

I am not sure, but a couple of things which would make it possible are.

1) PostgreSQL does generally report which file was corrupted.

2) The PostgreSQL log output rarely looks similar to regular data, so it should be obvious to anyone looking what is wrong if they do look at the contents of the file.

And most importantly they can always contact a PostgreSQL expert who could repair it.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#85

Post by jeltz » Thu, Apr 04, 2013, 5:24 PM UTC

mkopinsky wrote: post #65

joevandyk wrote: post #57

Earlier quoted context omitted.

Tom committed the fix, he didn't author it.

Who writes commit messages for these kinds of user-submitted patches? The author or the committer?

Usually the committer. Most patches sent to the mailing list does not contain a commit message.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#86

Post by selenamarie » Thu, Apr 04, 2013, 5:25 PM UTC

mkopinsky wrote: post #65

joevandyk wrote: post #57

Earlier quoted context omitted.

Tom committed the fix, he didn't author it.

Who writes commit messages for these kinds of user-submitted patches? The author or the committer?

Generally the committer writes the commit message. There is occassionally discussion of specific wording ahead of time.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#87

Post by selenamarie » Thu, Apr 04, 2013, 5:32 PM UTC

instakill wrote: post #79

Should one update the local postgres version? Any write ups on how exactly to go about it?

Yes. http://www.postgresql.org/docs/9.2/static/upgrading.html , second paragraph:

PostgreSQL major versions are represented by the first two digit groups of the version number, e.g., 8.4. PostgreSQL minor versions are represented by the third group of version digits, e.g., 8.4.2 is the second minor release of 8.4. Minor releases never change the internal storage format and are always compatible with earlier and later minor releases of the same major version number, e.g., 8.4.2 is compatible with 8.4, 8.4.1 and 8.4.6. To update between compatible versions, you simply replace the executables while the server is down and restart the server. The data directory remains unchanged — minor upgrades are that simple.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#88

Post by simon_kun » Thu, Apr 04, 2013, 5:54 PM UTC

It's testament to Canonical that Ubuntu 8.04 LTS still gets security patches backported to 8.3. If you (still) have servers running Hardy, it's 'apt-get upgrade' time: http://www.ubuntu.com/usn/usn-1789-1/

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#89

Post by brokenparser » Thu, Apr 04, 2013, 6:51 PM UTC

gingerlime wrote: post #81

craigkerstiens wrote: post #58

Earlier quoted context omitted.

Product manager of Heroku Postgres here; if you specifically need this functionality around point in time restores you should reach out to us. Would love to hear more around the use cases behind it.

Thanks Craig. I might do that, but I think we're too small fish for any kind of a bespoke solution. Given that you guys came up with WAL-E, I was secretly hoping this was somehow baked-into some magical heroku interface already...

I'm just glad the "I want magical stuff for free" kind of customer isn't restricted to any particular service or product.

Re: PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released

#90

Post by Bootvis » Thu, Apr 04, 2013, 7:06 PM UTC

rmc wrote: post #33

Bootvis wrote: post #8

I'm not an expert so I'll ask here: Is there an attack vector if you run PostgreSQL locally, no untrusted users are able to create connection strings and do not allow remote access? It seems to be no but I prefer to be sure ;)

To be sure, you should upgrade. Why do you not want to upgrade?

Thanks all for the information.

The reason I wanted to not upgrade directly is that access was hard at the moment of posting. Upgrading should never wait too long but this was (luckily) defcon 1 for us.