Auth bypass in Postgresql
CVE-2009-3231
The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.
Vulnerability class: Broken Authentication
EPSS: 0.076 (93.9th percentile) — read the EPSS interpretation.
Affected products
- Postgresql
- Canonical Ubuntu_linux — versions 6.06, 8.04, 8.10
- Fedoraproject Fedora — versions 10, 11
- Opensuse
- Suse Linux_enterprise — versions 10.0, 11.0
- Suse Linux_enterprise_server — versions 9
- N/a — versions n/a
Weakness classification (CWE)
Public proof-of-concept exploits
References
- cve@mitre.org (vendor-advisory, x_refsource_FEDORA, Mailing List)
- cve@mitre.org (x_refsource_CONFIRM, Release Notes)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, Broken Link, x_refsource_BID)
- cve@mitre.org (x_refsource_HP, vendor-advisory, Mailing List)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (x_refsource_CONFIRM, Broken Link, Vendor Advisory)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, Vendor Advisory, third-party-advisory)
- cve@mitre.org (mailing-list, x_refsource_BUGTRAQ, VDB Entry, Third Party Advisory, Broken Link)
- cve@mitre.org (x_refsource_SECUNIA, Broken Link, third-party-advisory)
- cve@mitre.org (vendor-advisory, Broken Link, x_refsource_DEBIAN)
Frequently asked questions
- What is CVE-2009-3231?
- CVE-2009-3231 is a vulnerability in Postgresql, classified under Improper Authentication. Published 2009-09-17.
- Is CVE-2009-3231 known to be exploited?
- 12 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.