CVE-2019-9193: Not a Security Vulnerability

#1

Post by proboscis » Sun, Apr 14, 2019, 2:46 PM UTC

CVE-2019-9193: Not a Security Vulnerability
postgresql.org

Re: CVE-2019-9193: Not a Security Vulnerability

#2

Post by Tostino » Sun, Apr 14, 2019, 3:04 PM UTC

After reading the discussion, that seems like the entirely right call.

The security researchers did not seem too concerned with the feedback they got from the community prior to releasing this CVE.

Re: CVE-2019-9193: Not a Security Vulnerability

#3

Post by StreamBright » Sun, Apr 14, 2019, 3:18 PM UTC

Is this the same as somebody executes sudo bash and observes that he got root prompt?

Re: CVE-2019-9193: Not a Security Vulnerability

#4

Post by kerng » Sun, Apr 14, 2019, 3:20 PM UTC

Sounds the same as xp_cmdshell scenarios in past. Although worth pointing out Microsoft there did lock down things further to even disable the feature and it has to be turned on explicitly.

That's possibly an improvement Postgress can do to avoid easy pivoting. Its what a less defensive security reply would include, because if hackers use it to pivot it might not look good down the road.

But from a pure argument standpoint Postgres is correct, it's more of a defense in depth strategy.

Re: CVE-2019-9193: Not a Security Vulnerability

#5

Post by lloydde » Sun, Apr 14, 2019, 3:21 PM UTC

Direct link to “CVE-2019-9193: Not a Security Vulnerability” https://www.postgresql.org/about/news/1935/

Which is also currently a banner at postgresql.org titled “4th April 2019: CVE-2019-9193: Not a Security Vulnerability”

Re: CVE-2019-9193: Not a Security Vulnerability

#6

Post by based2 » Sun, Apr 14, 2019, 3:22 PM UTC

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9193

Re: CVE-2019-9193: Not a Security Vulnerability

#7

Post by ZeroCool2u » Sun, Apr 14, 2019, 3:24 PM UTC

TL;DR Don't grant root to strangers, because they might do something rude with your db.

Re: CVE-2019-9193: Not a Security Vulnerability

#8

Post by mutagen » Sun, Apr 14, 2019, 3:24 PM UTC

Tostino wrote: post #2

After reading the discussion, that seems like the entirely right call. The security researchers did not seem too concerned with the feedback they got from the community prior to releasing this CVE.

Yeah, I discovered a flaw in SSH the other day, if my account on the remote server Is listed in the sudoers file I can escalate to root priviliges, as soon as I create a snazzy logo I'm going to get myself a CVE.

Seriously though, security research is starting to drift into bizarro land, security contacts at companies are inundated with port-scans asking for bug bounties because there's an open port and now people are registering CVEs on expected and documented behavior.

Re: CVE-2019-9193: Not a Security Vulnerability

#9

Post by kijin » Sun, Apr 14, 2019, 3:24 PM UTC

While the behavior described might be by design, I'm skeptical of any database query that involves accessing user-specified local files or executing system commands. (MySQL also has the infamous LOAD DATA INFILE query.) They look like band-aids designed for people who can't be bothered to import/export their data using standard shell commands, scripts, pipes, and database-specific dump/restore tools. These kinds of features should be disabled by default.

Re: CVE-2019-9193: Not a Security Vulnerability

#10

Post by ajross » Sun, Apr 14, 2019, 3:26 PM UTC

lloydde wrote: post #5

Direct link to “CVE-2019-9193: Not a Security Vulnerability” https://www.postgresql.org/about/news/1935/ Which is also currently a banner at postgresql.org titled “4th April 2019: CVE-2019-9193: Not a Security Vulnerability”

Per the links in the NVC CVE page, the reporter seems to have retracted it too.

It was a bad report. To be fair, it's also a bad feature. But bad features working as intended shouldn't be "vulnerabilities".