CVE-2007-6600 Privilege escalation in n/a
Remote authenticated users can gain superuser privileges by exploiting index functions during VACUUM or ANALYZE operations in PostgreSQL.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2007-6600?
CVE-2007-6600 is a medium-severity vulnerability in Postgresql Postgresql, published on 9 Jan 2008. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PostgreSQL 8.2 before 8.2.6, 8.1 before 8.1.11, 8.0 before 8.0.15, 7.4 before 7.4.19, and 7.3 before 7.3.21 uses superuser privileges instead of table owner privileges for (1) VACUUM and (2) ANALYZE operations within index functions, and supports (3) SET ROLE and (4) SET SESSION AUTHORIZATION within index functions, which allows remote authenticated users to gain privileges.
Weakness: CWE-264
Which versions are affected by CVE-2007-6600?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2007-6600?
Upgrade to a fixed version.
Is CVE-2007-6600 being exploited?
There is no known exploitation of CVE-2007-6600 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as GHSA-r647-cwmv-xwwc.