Skip site navigation (1) Skip section navigation (2)

Re: [ANNOUNCE] IMPORTANT: two new PostgreSQL security problems found

From: "Greg Sabino Mullane" <greg(at)turnstep(dot)com>
To: pgsql-admin(at)postgresql(dot)org
Subject: Re: [ANNOUNCE] IMPORTANT: two new PostgreSQL security problems found
Date: 2005-05-04 23:44:18
Message-ID: 18991d8228b39e43384ac760ebf5b84d@biglumber.com (view raw or flat)
Thread:
Lists: pgsql-adminpgsql-announcepgsql-general
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1


> Considering that this is a security-related system catalog update, is
> there any way of providing some sort of signature for a message like
> this such that the community can feel that issuing some arcane commands
> as a superuser won't open a hole rather than close one?
  
An excellent point. Ideally someone (Tom) would be using GnuPG to sign
important messages like this with a digital signature. However, there are
a few checks one could do until that happens. One, compare his headers with
previous ones. Second, check the page at www.postgresql.org for a matching
announcement. Third, wait five minutes for the real Tom Lane to denounce any
fake email sent in his name. :)

If it makes you feel better, I'm 100% sure that was a legitimate email, and
I am going to sign this. :)

- --
Greg Sabino Mullane greg(at)turnstep(dot)com
PGP Key: 0x14964AC8 200505040739
http://biglumber.com/x/web?pk=2529DF6AB8F79407E94445B4BC9B906714964AC8

-----BEGIN PGP SIGNATURE-----

iD8DBQFCeLTwvJuQZxSWSsgRAtACAKDvyylXy1MliqSs8Jsoz7XicXmBagCgoprg
qKPTIVv55E3ne19OGvtOTHM=
=IFvp
-----END PGP SIGNATURE-----



In response to

pgsql-announce by date

Next:From: David FetterDate: 2005-05-09 07:11:04
Subject: == PostgreSQL Weekly News - May 08 2005 ==
Previous:From: Jeff -Date: 2005-05-04 14:28:19
Subject: Re: [ANNOUNCE] pgtop, display PostgreSQL processes in `top' style

pgsql-admin by date

Next:From: Gourish SingbalDate: 2005-05-05 12:22:56
Subject: Need help in data migration
Previous:From: Tom LaneDate: 2005-05-04 21:14:35
Subject: Re: Anything like varchar_pattern_ops in 7.3.x?

pgsql-general by date

Next:From: VladDate: 2005-05-05 00:49:59
Subject: postgresql replication
Previous:From: Tom LaneDate: 2005-05-04 23:27:38
Subject: Re: [INTERFACES] calculated identity field in views,

Privacy Policy | About PostgreSQL
Copyright © 1996-2014 The PostgreSQL Global Development Group