Vulnerability in Postgresql
CVE-2007-3280
The Database Link library (dblink) in PostgreSQL 8.1 implements functions via CREATE statements that map to arbitrary libraries based on the C programming language, which allows remote authenticated superusers to map and execute a function from any library, as demonstrated by using the system function in libc.so.6 to gain shell access.
EPSS: 0.255 (97.7th percentile) — read the EPSS interpretation.
Affected products
- Postgresql — versions 8.1
- N/a — versions n/a
Public proof-of-concept exploits
References
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (vendor-advisory, x_refsource_MANDRIVA)
- cve@mitre.org (x_refsource_OSVDB, vdb-entry)
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_MISC)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ)
Frequently asked questions
- What is CVE-2007-3280?
- CVE-2007-3280 is a vulnerability in Postgresql. Published 2007-06-19.
- Is CVE-2007-3280 known to be exploited?
- 6 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.