CVE-2009-3231

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 89%
VendorProductVersion
postgresqlpostgresql
8.2 ≤
𝑥
< 8.2.14
postgresqlpostgresql
8.3 ≤
𝑥
< 8.3.8
opensuseopensuse
10.3 ≤
𝑥
≤ 11.1
suselinux_enterprise
10.0:sp2
suselinux_enterprise
11.0
canonicalubuntu_linux
6.06
canonicalubuntu_linux
8.04
canonicalubuntu_linux
8.10
canonicalubuntu_linux
9.04
𝑥
= Vulnerable software versions
Ubuntu logo
Ubuntu Releases
Ubuntu Product
Codename
postgresql-8.3
jaunty
Fixed 8.3.8-0ubuntu9.04
released
intrepid
Fixed 8.3.8-0ubuntu8.10
released
hardy
Fixed 8.3.8-0ubuntu8.04
released
dapper
dne
Common Weakness Enumeration
References
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://secunia.com/advisories/36660
http://secunia.com/advisories/36727
http://secunia.com/advisories/36800
http://secunia.com/advisories/36837
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
http://www.postgresql.org/docs/8.3/static/release-8-3-8.html
http://www.postgresql.org/support/security.html
http://www.securityfocus.com/archive/1/509917/100/0/threaded
http://www.securityfocus.com/bid/36314
http://www.ubuntu.com/usn/usn-834-1
http://www.us.debian.org/security/2009/dsa-1900
https://bugzilla.redhat.com/show_bug.cgi?id=522084
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://secunia.com/advisories/36660
http://secunia.com/advisories/36727
http://secunia.com/advisories/36800
http://secunia.com/advisories/36837
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
http://www.postgresql.org/docs/8.3/static/release-8-3-8.html
http://www.postgresql.org/support/security.html
http://www.securityfocus.com/archive/1/509917/100/0/threaded
http://www.securityfocus.com/bid/36314
http://www.ubuntu.com/usn/usn-834-1
http://www.us.debian.org/security/2009/dsa-1900
https://bugzilla.redhat.com/show_bug.cgi?id=522084
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html