Quantum Secular Labs / Blog / Advisories

CVE-2016-3065: Postgresql: Denial of service

CVE-2016-3065 is rated critical with a CVSS v3.0 base score of 9.1 and affects Postgresql. Per its scoring, it can be exploited over the network, without authentication, without any user interaction.

Vulnerability description

The (1) brin_page_type and (2) brin_metapage_info functions in the pageinspect extension in PostgreSQL before 9.5.x before 9.5.2 allows attackers to bypass intended access restrictions and consequently obtain sensitive server memory information or cause a denial of service (server crash) via a crafted bytea value in a BRIN index page.

Severity breakdown

CVSS v3.0 9.1: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H

• Attack vector: Network. Exploitable remotely over the network, with no need for local or physical access.
• Attack complexity: Low. No special conditions; the attack can be repeated reliably.
• Privileges required: None. No account or prior access is needed.
• User interaction: None. No action from any user is needed.
• Scope: Unchanged. Impact stays within the vulnerable component.
• Confidentiality impact: High. Total loss of confidentiality; sensitive data can be fully disclosed.
• Integrity impact: None. No loss of integrity.
• Availability impact: High. Total loss of availability; the component can be shut down.

Affected products

• Postgresql: 9.5; 9.5.1

References

• http://www.postgresql.org/about/news/1656/
• http://git.postgresql.org/gitweb/?p=postgresql.git%3Ba=commitdiff%3Bh=bf78a6f107949fdfb513d1b45e30cefe04e09e4f
• http://www.postgresql.org/docs/current/static/release-9-5-2.html
• http://www.securitytracker.com/id/1035468