=====================================================================

                           CERT-Renater

               Note d'Information No. 2013/VULN124
_____________________________________________________________________

DATE                : 05/04/2013

HARDWARE PLATFORM(S): /

OPERATING SYSTEM(S) : Systems running PostgreSQL versions
                         prior to 9.2.4, 9.1.9, 9.0.13, 8.4.17.

======================================================================
http://www.postgresql.org/about/news/1456/
______________________________________________________________________


PostgreSQL 9.2.4, 9.1.9, 9.0.13 and 8.4.17 released
Posted on 2013-04-04

The PostgreSQL Global Development Group has released a security update
to all current versions of the PostgreSQL database system, including
versions 9.2.4, 9.1.9, 9.0.13, and 8.4.17. This update fixes a
high-exposure security vulnerability in versions 9.0 and later. All
users of the affected versions are strongly urged to apply the update
immediately.

A major security issue fixed in this release, CVE-2013-1899, makes it
possible for a connection request containing a database name that
begins with "-" to be crafted that can damage or destroy files within a
server's data directory. Anyone with access to the port the PostgreSQL
server listens on can initiate this request. This issue was discovered
by Mitsumasa Kondo and Kyotaro Horiguchi of NTT Open Source Software
Center.

Two lesser security fixes are also included in this release:
CVE-2013-1900, wherein random numbers generated by contrib/pgcrypto
functions may be easy for another database user to guess, and
CVE-2013-1901, which mistakenly allows an unprivileged user to run
commands that could interfere with in-progress backups. Finally, this
release fixes two security issues with the graphical installers for
Linux and Mac OS X: insecure passing of superuser passwords to a
script, CVE-2013-1903 and the use of predictable filenames in /tmp
CVE-2013-1902. Marko Kreen, Noah Misch and Stefan Kaltenbrunner
reported these issues, respectively.

We are grateful for each developer's efforts in making PostgreSQL more
secure.

This release also corrects several errors in management of GiST
indexes. After installing this update, it is advisable to REINDEX any
GiST indexes that meet one or more of the conditions described below.

This update release also contains fixes for many minor issues
discovered and patched by the PostgreSQL community in the last two
months, including:

    Fix GiST indexes to not use "fuzzy" geometric comparisons for box,
polygon, circle, and point columns
    Fix bugs in contrib/btree_gist for GiST indexes on text, bytea,
bit, and numeric columns
    Fix bugs in page splitting code for multi-column GiST indexes
    Fix buffer leak in WAL replay causing "incorrect local pin count"
errors
    Ensure crash recovery before entering archive recovery during
unclean shutdown when recovery.conf is present
    Avoid deleting not-yet-archived WAL files during crash recovery
    Fix race condition in DELETE RETURNING
    Fix possible planner crash after adding columns to a view depending
on another view
    Eliminate memory leaks in PL/Perl's spi_prepare() function
    Fix pg_dumpall to handle database names containing "=" correctly
    Avoid crash in pg_dump when an incorrect connection string is given
    Ignore invalid indexes in pg_dump and pg_upgrade
    Include only the current server version's subdirectory when backing
up a tablespace with pg_basebackup
    Add a server version check in pg_basebackup and pg_receivexlog
    Fix contrib/dblink to handle inconsistent settings of DateStyle or
IntervalStyle safely
    Fix contrib/pg_trgm's similarity() function to return zero for
trigram-less strings
    Enable building PostgreSQL with Microsoft Visual Studio 2012
    Update time zone data files for DST law changes in Chile, Haiti,
Morocco, Paraguay, and some Russian areas

As always, update releases only require installation of packages and a
database system restart. You do not need to dump/restore or use
pg_upgrade for this update release. Users who have skipped multiple
update releases may need to perform additional, post-update steps; see
the Release Notes for details.

Links:

    Download
    Release Notes
    Release FAQ


======================================================================

=========================================================
Serveur de référence du CERT-Renater
https://services.renater.fr/ssi/
=========================================================
+ CERT-RENATER          | tel : 01-53-94-20-44          +
+ 23 - 25 Rue Daviel    | fax : 01-53-94-20-41          +
+ 75013 Paris           | email: certsvp@renater.fr     +
=========================================================