mirror/postgresql
2
0
Fork 0
mirror of https://git.postgresql.org/git/postgresql.git synced 2025-01-24 18:55:04 +08:00
Code Issues Packages Projects Releases Wiki Activity
34,960 Commits 37 Branches 638 Tags 426 MiB
C 85.5%
PLpgSQL 5.9%
Perl 4.2%
Yacc 1.3%
Makefile 0.7%
Other 2.2%
17fe2793ea
Go to file
Tom Lane 17fe2793ea Fix insecure parsing of server command-line switches. 
An oversight in commit e710b65c1c allowed
database names beginning with "-" to be treated as though they were secure
command-line switches; and this switch processing occurs before client
authentication, so that even an unprivileged remote attacker could exploit
the bug, needing only connectivity to the postmaster's port.  Assorted
exploits for this are possible, some requiring a valid database login,
some not.  The worst known problem is that the "-r" switch can be invoked
to redirect the process's stderr output, so that subsequent error messages
will be appended to any file the server can write.  This can for example be
used to corrupt the server's configuration files, so that it will fail when
next restarted.  Complete destruction of database tables is also possible.

Fix by keeping the database name extracted from a startup packet fully
separate from command-line switches, as had already been done with the
user name field.

The Postgres project thanks Mitsumasa Kondo for discovering this bug,
Kyotaro Horiguchi for drafting the fix, and Noah Misch for recognizing
the full extent of the danger.

Security: CVE-2013-1899
2013-04-01 14:00:51 -04:00
config Improve handling of ereport(ERROR) and elog(ERROR). 2013-01-13 18:40:09 -05:00
contrib pg_upgrade: don't copy/link files for invalid indexes 2013-03-30 22:20:53 -04:00
doc Update release notes for changes through today. 2013-03-31 18:59:35 -04:00
src Fix insecure parsing of server command-line switches. 2013-04-01 14:00:51 -04:00
.gitignore Add pkg-config files for libpq and ecpg libraries 2013-03-31 16:58:40 -04:00
aclocal.m4 Remove cvs keywords from all files. 2010-09-20 22:08:53 +02:00
configure Allow sepgsql labels to depend on object name. 2013-03-28 15:41:38 -04:00
configure.in Allow sepgsql labels to depend on object name. 2013-03-28 15:41:38 -04:00
COPYRIGHT Update copyrights for 2013 2013-01-01 17:15:01 -05:00
GNUmakefile.in Make init-po and update-po recursive make targets 2012-06-29 14:01:54 +03:00
Makefile Allow make check in PL directories 2011-02-15 06:52:12 +02:00
README Remove useless whitespace at end of lines 2010-11-23 22:34:55 +02:00
README.git Trivial typo fix. 2010-09-21 14:16:00 -04:00

README 

PostgreSQL Database Management System
=====================================

This directory contains the source code distribution of the PostgreSQL
database management system.

PostgreSQL is an advanced object-relational database management system
that supports an extended subset of the SQL standard, including
transactions, foreign keys, subqueries, triggers, user-defined types
and functions.  This distribution also contains C language bindings.

PostgreSQL has many language interfaces, many of which are listed here:

	http://www.postgresql.org/download

See the file INSTALL for instructions on how to build and install
PostgreSQL.  That file also lists supported operating systems and
hardware platforms and contains information regarding any other
software packages that are required to build or run the PostgreSQL
system.  Changes between all PostgreSQL releases are recorded in the
file HISTORY.  Copyright and license information can be found in the
file COPYRIGHT.  A comprehensive documentation set is included in this
distribution; it can be read as described in the installation
instructions.

The latest version of this software may be obtained at
http://www.postgresql.org/download/.  For more information look at our
web site located at http://www.postgresql.org/.