Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.

Metrics

No CVSS v4.0

No CVSS v3.1

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication Single

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact None

This CVE is not in the KEV list.

The EPSS score is 0.00659.

Key SSVC decision points have not yet been added.

Affected Vendors & Products

Vendors Products
Postgresql
  • Postgresql
Redhat
  • Cloudforms Managementengine
  • Enterprise Linux
  • Rhel Software Collections

Configuration 1 [-]

OR cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.16:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.17:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:8.4.18:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.12:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.13:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.14:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.0.15:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.7:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.8:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.9:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.10:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.1.11:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.2:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.4:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.5:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.2.6:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.3:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.3.1:*:*:*:*:*:*:*
cpe:2.3:a:postgresql:postgresql:9.3.2:*:*:*:*:*:*:*
Package CPE Advisory Released Date
CloudForms Management Engine 5.x
cfme-0:5.2.3.2-1.el6cf cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
postgresql92-postgresql-0:9.2.7-1.1.el6 cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
prince-0:9.0r2-4.el6cf cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
ruby193-rubygem-actionpack-1:3.2.13-6.el6cf cpe:/a:redhat:cloudforms_managementengine:5::el6 RHSA-2014:0469 2014-05-12T00:00:00Z
Red Hat Enterprise Linux 5
postgresql84-0:8.4.20-1.el5_10 cpe:/o:redhat:enterprise_linux:5 RHSA-2014:0211 2014-02-25T00:00:00Z
postgresql-0:8.1.23-10.el5_10 cpe:/o:redhat:enterprise_linux:5 RHSA-2014:0249 2014-03-04T00:00:00Z
Red Hat Enterprise Linux 6
postgresql-0:8.4.20-1.el6_5 cpe:/o:redhat:enterprise_linux:6 RHSA-2014:0211 2014-02-25T00:00:00Z
Red Hat Software Collections for RHEL-6
postgresql92-postgresql-0:9.2.7-1.1.el6 cpe:/a:redhat:rhel_software_collections:1::el6 RHSA-2014:0221 2014-02-27T00:00:00Z

No data.

Advisories
Source ID Title
Debian DSA Debian DSA DSA-2864-1 postgresql-8.4 security update
Debian DSA Debian DSA DSA-2865-1 postgresql-9.1 security update
EUVD EUVD EUVD-2014-0155 Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allows remote authenticated users to create an unauthorized index or read portions of unauthorized tables by creating or deleting a table with the same name during the timing window.
Ubuntu USN Ubuntu USN USN-2120-1 PostgreSQL vulnerabilities
Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References
Link Providers
http://archives.neohapsis.com/archives/bugtraq/2014-10/0103.html cve-icon cve-icon
http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705 cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2014-03/msg00018.html cve-icon cve-icon
http://lists.opensuse.org/opensuse-updates/2014-03/msg00038.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0211.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0221.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0249.html cve-icon cve-icon
http://rhn.redhat.com/errata/RHSA-2014-0469.html cve-icon cve-icon
http://secunia.com/advisories/61307 cve-icon cve-icon
http://support.apple.com/kb/HT6448 cve-icon cve-icon
http://wiki.postgresql.org/wiki/20140220securityrelease cve-icon cve-icon
http://www.debian.org/security/2014/dsa-2864 cve-icon cve-icon
http://www.debian.org/security/2014/dsa-2865 cve-icon cve-icon
http://www.oracle.com/technetwork/security-advisory/cpuoct2017-3236626.html cve-icon cve-icon
http://www.postgresql.org/about/news/1506/ cve-icon cve-icon
http://www.securityfocus.com/bid/65727 cve-icon cve-icon
http://www.ubuntu.com/usn/USN-2120-1 cve-icon cve-icon
https://nvd.nist.gov/vuln/detail/CVE-2014-0062 cve-icon
https://support.apple.com/kb/HT6536 cve-icon cve-icon
https://www.cve.org/CVERecord?id=CVE-2014-0062 cve-icon
History

No history.

cve-icon MITRE

Status: PUBLISHED

Assigner: redhat

Published:

Updated: 2024-08-06T09:05:38.393Z

Reserved: 2013-12-03T00:00:00

Link: CVE-2014-0062

cve-icon Vulnrichment

No data.

cve-icon NVD

Status : Deferred

Published: 2014-03-31T14:58:15.397

Modified: 2025-04-12T10:46:40.837

Link: CVE-2014-0062

cve-icon Redhat

Severity : Moderate

Publid Date: 2014-02-17T00:00:00Z

Links: CVE-2014-0062 - Bugzilla

cve-icon OpenCVE Enrichment

No data.