CVE-2006-5540 Denial of service in n/a
Authenticated remote users can crash the PostgreSQL daemon by exploiting a flaw in aggregate function handling during index optimization.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2006-5540?
CVE-2006-5540 is a medium-severity denial of service vulnerability in Postgresql Postgresql, published on 26 Oct 2006. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
backend/parser/analyze.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via certain aggregate functions in an UPDATE statement, which are not properly handled during a "MIN/MAX index optimization."
Which versions are affected by CVE-2006-5540?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2006-5540?
Upgrade to a fixed version.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2006-5540 being exploited?
There is no known exploitation of CVE-2006-5540 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as GHSA-5wmv-4mw3-5frc.