Vulnerability Note VU#891177

PostgreSQL VACUUM command allows unprivileged user to remove database transaction log data

Overview

The PostgreSQL VACUUM command contains a vulnerability that allows an unprivileged user to remove database transaction log data. This may result in unrecoverable data loss.

I. Description

PostgreSQL is a database management system. The PostgreSQL VACUUM command is used to clean out records from rolled back transactions and update statistics in the system catalog. There is a flaw in the PostgreSQL VACUUM command that could allow an unprivileged user to remove database transaction log data prematurely.

II. Impact

An attacker could remove database transaction log data. The premature removal of transaction logs may result in unrecoverable data loss.

III. Solution

Upgrade

This issue was fixed in version 7.2.3 of PostgreSQL.

Systems Affected

Vendor	Status	Date Notified	Date Updated
PostgreSQL	Vulnerable	15-Jan-2004

References

http://www.postgresql.org
https://rhn.redhat.com/errata/RHSA-2003-001.html
http://www.postgresql.org/docs/6.5/interactive/sql-vacuum-1.htm

Credit

Thanks to Red Hat for the information contained in their security advisory.

This document was written by Damon Morda.

Other Information

Date Public:	2002-10-01
Date First Published:	2004-01-15
Date Last Updated:	2004-01-15
CERT Advisory:
CVE-ID(s):
NVD-ID(s):
US-CERT Technical Alerts:
Severity Metric:	3.75
Document Revision:	13

If you have feedback, comments, or additional information about this vulnerability, please send us email.