CVE-2009-4136 Privilege escalation in n/a
Authenticated users can escalate privileges to superuser by exploiting improper session state management in crafted index functions.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2009-4136?
CVE-2009-4136 is a medium-severity vulnerability in Postgresql Postgresql, published on 15 Dec 2009. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
PostgreSQL 7.4.x before 7.4.27, 8.0.x before 8.0.23, 8.1.x before 8.1.19, 8.2.x before 8.2.15, 8.3.x before 8.3.9, and 8.4.x before 8.4.2 does not properly manage session-local state during execution of an index function by a database superuser, which allows remote authenticated users to gain privileges via a table with crafted index functions, as demonstrated by functions that modify (1) search_path or (2) a prepared statement, a related issue to CVE-2007-6600 and CVE-2009-3230.
Which versions are affected by CVE-2009-4136?
It affects 1 product.
Products include Postgresql Postgresql.
How do I fix CVE-2009-4136?
Upgrade to a fixed version.
Is CVE-2009-4136 being exploited?
There is no known exploitation of CVE-2009-4136 in the wild and no public exploit code.
Other vulnerabilities in Postgresql Postgresql
Sources
Also known as GHSA-p8jm-5754-gqxq.