Re: @(#)Mordred Labs advisory 0x0007: Remove DoS in PostgreSQL

From: Chris Humphries <chumphries(at)devis(dot)com>
To: Lamar Owen <lamar(dot)owen(at)wgcr(dot)org>
Cc: Sir Mordred The Traitor <mordred(at)s-mail(dot)com>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: @(#)Mordred Labs advisory 0x0007: Remove DoS in PostgreSQL
Date: 2002-08-26 16:25:35
Message-ID: 15722.22143.470646.377742@metalico.drauku.net
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-hackers

so basically if you are an idiot admin, and leave the postgresql box
open (explicitly opening stuff), and under certian conditions, you can
get DoS'd? hrm, this may not be your biggest problem.

maybe if the dba has a clue and only explicitly allows certian ips
to even route to the box, and then certian users (1 or 2 or so) that
is not available to the public (ie, internet), they would be better off.
i would be that with the lazy/ignorant setup of the dba/admin, that a
DoS of postgresql is not the biggest problem, sure one of their redhat
boxes has gotten rooted already...

there is nothing that is more important for security and databases than
setting them up correctly, and their place on the network. the database
is the crown jewel that should never been seen or touched except for when
_absolutely_ needed, and that must be under heavy control.

there is a bigger problem here than postgresql, it is the dumbass factor
of people that try to run a db, and are vuln to anything... and then complain
about it... i find this very annoying.

know what you are doing, or stfu is my opinion

-chris

ps -> note this was not directed at any one person, but to the mass of
people that never should run a db, and go back to eating paint chips.
-----
disclaimer: i do not speak on behalf of devis (devis.com). i speak
on my own behalf.
-----

</rant-mode>

Lamar Owen writes:
> On Monday 26 August 2002 10:46 am, Sir Mordred The Traitor wrote:
> > Conditions: entry in a pg_hba.conf file that matches attacker's host.
> > Risk: average
>
> > --[ Solution
> >
> > Disable network access for untrusted users.
>
> TCP/IP access must be enabled as well. TCP/IP accessibility is OFF by
> default.
>
> I for one thought that it was normal operating procedure to only allow access
> to trusted machines; maybe I'm odd in that regard.
>
> Hey, if I can connect to postmaster I can DoS it quite easily, but flooding it
> with connection requests.....
>
> But, if we can thwart this, all the better.
> --
> Lamar Owen
> WGCR Internet Radio
> 1 Peter 4:11
>
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
> subscribe-nomail command to majordomo(at)postgresql(dot)org so that your
> message can get through to the mailing list cleanly

--
Chris Humphries
Development InfoStructure
540.366.9809

In response to

Browse pgsql-hackers by date

  From Date Subject
Next Message Bruce Momjian 2002-08-26 16:59:08 Re: @(#)Mordred Labs advisory 0x0007: Remove DoS in PostgreSQL
Previous Message Bruce Momjian 2002-08-26 16:16:32 Re: [HACKERS] TODO Done. Superuser backend slot reservations