Tom Lane 17fe2793ea Fix insecure parsing of server command-line switches. ... An oversight in commit e710b65c1c allowed database names beginning with "-" to be treated as though they were secure command-line switches; and this switch processing occurs before client authentication, so that even an unprivileged remote attacker could exploit the bug, needing only connectivity to the postmaster's port. Assorted exploits for this are possible, some requiring a valid database login, some not. The worst known problem is that the "-r" switch can be invoked to redirect the process's stderr output, so that subsequent error messages will be appended to any file the server can write. This can for example be used to corrupt the server's configuration files, so that it will fail when next restarted. Complete destruction of database tables is also possible. Fix by keeping the database name extracted from a startup packet fully separate from command-line switches, as had already been done with the user name field. The Postgres project thanks Mitsumasa Kondo for discovering this bug, Kyotaro Horiguchi for drafting the fix, and Noah Misch for recognizing the full extent of the danger. Security: CVE-2013-1899		2013-04-01 14:00:51 -04:00
..
autovacuum.c	Add lock_timeout configuration parameter.	2013-03-16 23:22:57 -04:00
bgwriter.c	Update copyrights for 2013	2013-01-01 17:15:01 -05:00
checkpointer.c	Update copyrights for 2013	2013-01-01 17:15:01 -05:00
fork_process.c	Reset OpenSSL randomness state in each postmaster child process.	2013-03-27 18:50:21 -04:00
Makefile	Refactor xlog.c to create src/backend/postmaster/startup.c	2011-11-02 14:25:01 +00:00
pgarch.c	Update copyrights for 2013	2013-01-01 17:15:01 -05:00
pgstat.c	Add a materialized view relations.	2013-03-03 18:23:31 -06:00
postmaster.c	Fix insecure parsing of server command-line switches.	2013-04-01 14:00:51 -04:00
startup.c	Update copyrights for 2013	2013-01-01 17:15:01 -05:00
syslogger.c	Also fix rotation of csvlog on Windows.	2013-01-24 11:41:30 +02:00
walwriter.c	Update copyrights for 2013	2013-01-01 17:15:01 -05:00