| From: | Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us> |
|---|---|
| To: | Martijn van Oosterhout <kleptog(at)svana(dot)org> |
| Cc: | Robert Haas <robertmhaas(at)gmail(dot)com>, Alvaro Herrera <alvherre(at)alvh(dot)no-ip(dot)org>, pgsql-hackers <pgsql-hackers(at)postgresql(dot)org> |
| Subject: | Re: temporary functions (and other object types) |
| Date: | 2010-11-06 15:36:58 |
| Message-ID: | 19622.1289057818@sss.pgh.pa.us |
| Views: | Raw Message | Whole Thread | Download mbox | Resend email |
| Thread: | |
| Lists: | pgsql-hackers |
Martijn van Oosterhout <kleptog(at)svana(dot)org> writes:
> On Fri, Nov 05, 2010 at 09:01:50PM -0400, Robert Haas wrote:
>> I see that there could be a problem here with SECURITY DEFINER
>> functions, but I'm not clear whether it goes beyond that?
> IIRC correctly it's because even unpriveledged users can make things in
> the pg_temp schema and it's implicitly at the front of the search_path.
> There was a CVE about this a while back, no?
Yeah, we changed that behavior as part of the fix for CVE-2007-2138.
You'd need either SECURITY DEFINER functions or very careless use of
SET ROLE/SET SESSION AUTHORIZATION for the issue to be exploitable.
regards, tom lane
| From | Date | Subject | |
|---|---|---|---|
| Next Message | Tom Lane | 2010-11-06 15:48:27 | Re: Protecting against unexpected zero-pages: proposal |
| Previous Message | Bruce Momjian | 2010-11-06 15:31:41 | PL/pgSQL and shared_preload_libraries |