CVE-2005-1410 Denial of service in n/a
Attackers can crash the PostgreSQL database by calling specific internal functions via SQL commands, requiring low privileges.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2005-1410?
CVE-2005-1410 is a low-severity denial of service vulnerability in Postgresql Postgresql, published on 3 May 2005. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The tsearch2 module in PostgreSQL 7.4 through 8.0.x declares the (1) dex_init, (2) snb_en_init, (3) snb_ru_init, (4) spell_init, and (5) syn_init functions as "internal" even when they do not take an internal argument, which allows attackers to cause a denial of service (application crash) and possibly have other impacts via SQL commands that call other functions that accept internal arguments.
Which versions are affected by CVE-2005-1410?
It affects 2 products.
Products include Postgresql Postgresql, Trustix Secure Linux.
How do I fix CVE-2005-1410?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2005-1410 being exploited?
There is no known exploitation of CVE-2005-1410 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as GHSA-43pr-qcpc-578c.