Vulnerability in Enterprisedb Postgres Advanced Server

CVE-2007-4639

EnterpriseDB Advanced Server 8.2 does not properly handle certain debugging function calls that occur before a call to pldbg_create_listener, which allows remote authenticated users to cause a denial of service (daemon crash) and possibly execute arbitrary code via a SELECT statement that invokes a pldbg_ function, as demonstrated by (1) pldbg_get_stack and (2) pldbg_abort_target, which triggers use of an uninitialized pointer.

EPSS: 0.051 (91.5th percentile) — read the EPSS interpretation.

Affected products

Enterprisedb Postgres_advanced_server — versions 8.2
N/a — versions n/a

Weakness classification (CWE)

CWE-824 — Access of Uninitialized Pointer

References

cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory, Broken Link)
cve@mitre.org (Exploit, VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_XF)
cve@mitre.org (vdb-entry, Broken Link, x_refsource_VUPEN)
cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)