Dissecting PostgreSQL CVE-2013-1899
blog.blackwinghq.com
Dissecting PostgreSQL CVE-2013-1899
1–8 of 8 posts
Re: Dissecting PostgreSQL CVE-2013-1899
#2Nice article.
> Now we have to wait for an administrator to “su – postgres”. Likely? Eh.
This isn't that unlikely. On Debian/Ubuntu, postgres is the database super user and doesn't have a password set by default so the way to administer PostgreSQL is to su to postgres and then run psql/createdb/etc (it relies on local ident authentication).
Re: Dissecting PostgreSQL CVE-2013-1899
#3Nice article. > Now we have to wait for an administrator to “su – postgres”. Likely? Eh. This isn't that unlikely. On Debian/Ubuntu, postgres is the database super user and doesn't have a password set by default so the way to administer PostgreSQL is to su to postgres and then run psql/createdb/etc (it relies on local ident authentication).
Exactly, I have done this today!
Re: Dissecting PostgreSQL CVE-2013-1899
#4Very creative. And scary! The shell script could download and run any binary.
Would be neat if there were an exploit which injected something to make further injection impossible.
Re: Dissecting PostgreSQL CVE-2013-1899
#5The latest data from Shodan shows that there are at least 10,610 vulnerable systems (189,680 public PostgreSQL database instances were tested).
Re: Dissecting PostgreSQL CVE-2013-1899
#6Nice article. > Now we have to wait for an administrator to “su – postgres”. Likely? Eh. This isn't that unlikely. On Debian/Ubuntu, postgres is the database super user and doesn't have a password set by default so the way to administer PostgreSQL is to su to postgres and then run psql/createdb/etc (it relies on local ident authentication).
Yes, it's not unlikely at all. It's a timebomb just waiting to explode.
Re: Dissecting PostgreSQL CVE-2013-1899
#7Very creative. And scary! The shell script could download and run any binary. Would be neat if there were an exploit which injected something to make further injection impossible.
ehm. anti-virus? there's a whole discussion about it, i won't go into here.
but what can an anti-virus do? best would be to patch the database (might be pretty hard). then it could write something like: echo "you have been hacked!"; exit 0 into the .profile. that will let the user spot the cracking attempt.
Re: Dissecting PostgreSQL CVE-2013-1899
#8Very creative. And scary! The shell script could download and run any binary. Would be neat if there were an exploit which injected something to make further injection impossible.
ehm. anti-virus? there's a whole discussion about it, i won't go into here. but what can an anti-virus do? best would be to patch the database (might be pretty hard). then it could write something like: echo "you have been hacked!"; exit 0 into the .profile. that will let the user spot the cracking attempt.
What....are you talking about