Test ID:	1.3.6.1.4.1.25623.1.0.703269
Category:	Debian Local Security Checks
Title:	Debian Security Advisory DSA 3269-1 (postgresql-9.1 - security update)
Summary:	Several vulnerabilities have been found in PostgreSQL-9.1, a SQL;database system.;;CVE-2015-3165;;(Remote crash);;SSL clients disconnecting just before the authentication timeout;expires can cause the server to crash.;;CVE-2015-3166;;(Information exposure);;The replacement implementation of snprintf() failed to check for;errors reported by the underlying system library calls, the main;case that might be missed is out-of-memory situations. In the worst;case this might lead to information exposure.;;CVE-2015-3167;;(Possible side-channel key exposure);;In contrib/pgcrypto, some cases of decryption with an incorrect key;could report other error message texts. Fix by using a;one-size-fits-all message.
Description:	Summary: Several vulnerabilities have been found in PostgreSQL-9.1, a SQL database system. CVE-2015-3165 (Remote crash) SSL clients disconnecting just before the authentication timeout expires can cause the server to crash. CVE-2015-3166 (Information exposure) The replacement implementation of snprintf() failed to check for errors reported by the underlying system library calls, the main case that might be missed is out-of-memory situations. In the worst case this might lead to information exposure. CVE-2015-3167 (Possible side-channel key exposure) In contrib/pgcrypto, some cases of decryption with an incorrect key could report other error message texts. Fix by using a one-size-fits-all message. Affected Software/OS: postgresql-9.1 on Debian Linux Solution: For the oldstable distribution (wheezy), these problems have been fixed in version 9.1.16-0+deb7u1. For the stable distribution (jessie), these problems have been fixed in version 9.1.16-0+deb8u1. (Jessie contains a reduced postgresql-9.1 package, only CVE-2015-3166 is fixed in the produced binary package postgresql-plperl-9.1. We recommend to upgrade to postgresql-9.4 to get the full set of fixes. See the Jessie release notes for details.) The testing distribution (stretch) and the unstable distribution (sid) do not contain the postgresql-9.1 package. We recommend that you upgrade your postgresql-9.1 packages. CVSS Score: 7.5 CVSS Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2015-3165 http://lists.apple.com/archives/security-announce/2015/Sep/msg00004.html BugTraq ID: 74787 http://www.securityfocus.com/bid/74787 Debian Security Information: DSA-3269 (Google Search) http://www.debian.org/security/2015/dsa-3269 Debian Security Information: DSA-3270 (Google Search) http://www.debian.org/security/2015/dsa-3270 https://security.gentoo.org/glsa/201507-20 RedHat Security Advisories: RHSA-2015:1194 http://rhn.redhat.com/errata/RHSA-2015-1194.html RedHat Security Advisories: RHSA-2015:1195 http://rhn.redhat.com/errata/RHSA-2015-1195.html RedHat Security Advisories: RHSA-2015:1196 http://rhn.redhat.com/errata/RHSA-2015-1196.html http://www.ubuntu.com/usn/USN-2621-1 Common Vulnerability Exposure (CVE) ID: CVE-2015-3166 http://ubuntu.com/usn/usn-2621-1 http://www.postgresql.org/about/news/1587/ http://www.postgresql.org/docs/9.0/static/release-9-0-20.html http://www.postgresql.org/docs/9.1/static/release-9-1-16.html http://www.postgresql.org/docs/9.2/static/release-9-2-11.html http://www.postgresql.org/docs/9.3/static/release-9-3-7.html http://www.postgresql.org/docs/9.4/static/release-9-4-2.html Common Vulnerability Exposure (CVE) ID: CVE-2015-3167
Copyright	Copyright (c) 2015 Greenbone Networks GmbH http://greenbone.net

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.