postgresql/src
Tom Lane 17fe2793ea Fix insecure parsing of server command-line switches.
An oversight in commit e710b65c1c allowed
database names beginning with "-" to be treated as though they were secure
command-line switches; and this switch processing occurs before client
authentication, so that even an unprivileged remote attacker could exploit
the bug, needing only connectivity to the postmaster's port.  Assorted
exploits for this are possible, some requiring a valid database login,
some not.  The worst known problem is that the "-r" switch can be invoked
to redirect the process's stderr output, so that subsequent error messages
will be appended to any file the server can write.  This can for example be
used to corrupt the server's configuration files, so that it will fail when
next restarted.  Complete destruction of database tables is also possible.

Fix by keeping the database name extracted from a startup packet fully
separate from command-line switches, as had already been done with the
user name field.

The Postgres project thanks Mitsumasa Kondo for discovering this bug,
Kyotaro Horiguchi for drafting the fix, and Noah Misch for recognizing
the full extent of the danger.

Security: CVE-2013-1899
2013-04-01 14:00:51 -04:00
..
backend Fix insecure parsing of server command-line switches. 2013-04-01 14:00:51 -04:00
bin Must check indisready not just indisvalid when dumping from 9.2 server. 2013-03-28 22:09:12 -04:00
common Move relpath() to libpgcommon 2013-02-21 22:46:17 -03:00
include Fix insecure parsing of server command-line switches. 2013-04-01 14:00:51 -04:00
interfaces Revert "ecpg: Don't link compatlib with libpq" 2013-03-31 23:50:51 -04:00
makefiles Blind attempt at fixing the non-MSVC Windows builds 2013-02-22 11:51:15 -03:00
pl Move pqsignal() to libpgport. 2013-03-17 12:06:42 -04:00
port initdb needs pqsignal() even on Windows. 2013-03-17 15:19:47 -04:00
template Remove _FORTIFY_SOURCE 2012-10-10 21:42:38 -04:00
test Add new JSON processing functions and parser API. 2013-03-29 14:12:13 -04:00
timezone Update time zone data files to tzdata release 2013b. 2013-03-28 15:25:48 -04:00
tools Add parallel pg_dump option. 2013-03-24 11:27:20 -04:00
tutorial Modernize string literal syntax in tutorial example. 2013-01-19 17:20:32 -05:00
.gitignore Convert cvsignore to gitignore, and add .gitignore for build targets. 2010-09-22 12:57:04 +02:00
bcc32.mak Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00
DEVELOPERS Replace a couple of references to files that no longer exist in the source 2009-05-04 08:08:47 +00:00
Makefile Create libpgcommon, and move pg_malloc et al to it 2013-02-12 11:21:05 -03:00
Makefile.global.in Create libpgcommon, and move pg_malloc et al to it 2013-02-12 11:21:05 -03:00
Makefile.shlib Add pkg-config files for libpq and ecpg libraries 2013-03-31 16:58:40 -04:00
nls-global.mk NLS: Use msgmerge --previous option 2012-12-13 23:12:12 -05:00
win32.mak Autoconfiscate selection of 64-bit int type for 64-bit large object API. 2012-10-07 21:52:43 -04:00