Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

CVE-2019-9193: Not a Security Vulnerability

postgresql.org

Post reply on HN
Print view View original

41–50 of 84 posts

Re: CVE-2019-9193: Not a Security Vulnerability

#41

Post by hobs »

michelpp wrote: post #20
kerng wrote: post #4

Sounds the same as xp_cmdshell scenarios in past. Although worth pointing out Microsoft there did lock down things further to even disable the feature and it has to be turned on explicitly. That's possibly an improvement Postgress can do to avoid easy pivoting. Its what a less defensive security reply would include, because if hackers use it to pivot it might not look good down the road. But from a pure argument stan…

Quoting Andreas Freund from the mailing list: """ Btw, the xp_cmdshell thing the author references several times? It can be enabled via tsql if you have a privileged account. https://docs.microsoft.com/en-us/sql/database-engine/configu... and it allows to execute shell code (as a specified user) even when not a sysadmin: https://docs.microsoft.com/en-us/sql/relational-databases/sy... """ so no MS didn't really "lock…

If you make a proxy account, AS AN ADMIN. I have personally walked dozens of DBAs through making said proxy account as it was non-trivial to accomplish.

Please stop repeating this FUD.

Re: CVE-2019-9193: Not a Security Vulnerability

#42

Post by dx87 »

mutagen wrote: post #8
Tostino wrote: post #2

After reading the discussion, that seems like the entirely right call. The security researchers did not seem too concerned with the feedback they got from the community prior to releasing this CVE.

Yeah, I discovered a flaw in SSH the other day, if my account on the remote server Is listed in the sudoers file I can escalate to root priviliges, as soon as I create a snazzy logo I'm going to get myself a CVE. Seriously though, security research is starting to drift into bizarro land, security contacts at companies are inundated with port-scans asking for bug bounties because there's an open port and now people ar…

A couple of years ago someone made a website about the "Grinch" vulnerability, saying it was going to be bigger than shellshock. The "vulnerability" was that members of the "wheel" admin group could use sudo to run commands as root without a password. Needless to say, RedHat replied that it was intended behavior, but not until the researcher got their 15 minutes of fame on a bunch of tech websites.

https://access.redhat.com/articles/1298913

Re: CVE-2019-9193: Not a Security Vulnerability

#43

Post by felixrabe »

michaelhoffman wrote: post #13

"It rather involved being on the other side of this airtight hatchway: Writing to the application directory" (2012) Raymond Chen on "security vulnerabilities" that depend on already having superuser status. https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=58... Looks like Microsoft messed up the line breaks on switching to a new blog platform.

Re line breaks: That's Microsoft being poetic :)

Re: CVE-2019-9193: Not a Security Vulnerability

#44

Post by michelpp »

hobs wrote: post #41
michelpp wrote: post #20

Earlier quoted context omitted.

Quoting Andreas Freund from the mailing list: """ Btw, the xp_cmdshell thing the author references several times? It can be enabled via tsql if you have a privileged account. https://docs.microsoft.com/en-us/sql/database-engine/configu... and it allows to execute shell code (as a specified user) even when not a sysadmin: https://docs.microsoft.com/en-us/sql/relational-databases/sy... """ so no MS didn't really "lock…

If you make a proxy account, AS AN ADMIN. I have personally walked dozens of DBAs through making said proxy account as it was non-trivial to accomplish. Please stop repeating this FUD.

You cannot run COPY...PROGRAM without a permission that can only be granted to you by a superuser and which is not granted by default. I'm failing to see the distinction.

Postgres is just a process that happens to do a lot of I/O. It's no different than any other Unix process: it can spawn children, it can dynamically load libraries on request. It protects these powerful tools with permissions, which is the sane and correct approach taken by many, many other languages and frameworks, all just unix processes, all just trying to get shit done.

Re: CVE-2019-9193: Not a Security Vulnerability

#46

Post by jakobegger »

codedokode wrote: post #38
michelpp wrote: post #15

Earlier quoted context omitted.

COPY TO/FROM PROGRAM is not a bad feature. It is in fact an amazing and wonderful thing that makes ETL with Postgres much more powerful. Almost all language runtimes can spawn subprocesses. What is your rational for declaring it "bad" with no explanation?

There is ssh which is secure and encrypted. There is no need to invent new unencrypted and insecure remote shell protocol thus increasing attack surface without getting any noticeable benefits.

How about not giving people superuser privileges instead of asking for useful features to be dropped?

Re: CVE-2019-9193: Not a Security Vulnerability

#47

Post by bdarnell »

I think this is an argument for not giving root/superuser all possible permissions by default. It's OK that granting the `pg_execute_server_program` permission gives access to this feature, but it should still be something you have to opt in to, instead of making database superuser equivalent to the host user that the database runs as.

For comparison, in CockroachDB (disclosure: I'm a co-founder of Cockroach Labs), we don't have any features that let you execute server programs, but we do have something analogous to `pg_{read,write}_server_files` via the BACKUP, RESTORE, and IMPORT commands. In order to use these commands with a target on the server's filesystem, though, the database `admin` role isn't enough. The server also needs to be started with the `--external-io-dir` flag (and file operations will be limited to that directory). This gives an extra layer of opt-in before filesystem operations are allowed.

Re: CVE-2019-9193: Not a Security Vulnerability

#48

Post by sctb »

lloydde wrote: post #5

Direct link to “CVE-2019-9193: Not a Security Vulnerability” https://www.postgresql.org/about/news/1935/ Which is also currently a banner at postgresql.org titled “4th April 2019: CVE-2019-9193: Not a Security Vulnerability”

Thanks, we've updated the link here from https://meterpreter.org/postgresql-announces-to-deny-cve-201....

Re: CVE-2019-9193: Not a Security Vulnerability

#49

Post by hopler »

michelpp wrote: post #44
hobs wrote: post #41

Earlier quoted context omitted.

If you make a proxy account, AS AN ADMIN. I have personally walked dozens of DBAs through making said proxy account as it was non-trivial to accomplish. Please stop repeating this FUD.

You cannot run COPY...PROGRAM without a permission that can only be granted to you by a superuser and which is not granted by default. I'm failing to see the distinction. Postgres is just a process that happens to do a lot of I/O. It's no different than any other Unix process: it can spawn children, it can dynamically load libraries on request. It protects these powerful tools with permissions, which is the sane and…

sudo exists, even though an admin could just log in as root all the time, because it's safer to keep your gun unloaded when you aren't planning to use it immediately. Keeping your gun loaded isn't a security flaw, but it is dangerous.

Re: CVE-2019-9193: Not a Security Vulnerability

#50

Post by gruez »

michaelhoffman wrote: post #13

"It rather involved being on the other side of this airtight hatchway: Writing to the application directory" (2012) Raymond Chen on "security vulnerabilities" that depend on already having superuser status. https://devblogs.microsoft.com/oldnewthing/20121207-00/?p=58... Looks like Microsoft messed up the line breaks on switching to a new blog platform.

archived version with proper formatting: https://web.archive.org/web/20170411085434/https://blogs.msd...
Post reply on HN