Re: [SECURITY] DoS attack on backend possible (was: Re:

From: Don Baccus <dhogaza(at)pacifier(dot)com>
To: Gavin Sherry <swm(at)linuxworld(dot)com(dot)au>
Cc: Florian Weimer <Weimer(at)CERT(dot)Uni-Stuttgart(dot)DE>, pgsql-hackers(at)postgresql(dot)org
Subject: Re: [SECURITY] DoS attack on backend possible (was: Re:
Date: 2002-08-12 14:26:44
Message-ID: 3D57C5A4.4020001@pacifier.com
Views: Raw Message | Whole Thread | Download mbox | Resend email
Thread:
Lists: pgsql-committers pgsql-hackers

Gavin Sherry wrote:

> As to your other point -- that this bug in the data/time code actually
> *reflects* the quality and reliability of the database itself -- you've
> really gone too far. The best software has bugs.

For example, in the current version of Oracle 9i, if a client (say
SQL*Plus) is running on a linux box and talking to Oracle running on a
Solaris box, executes the following:

create table foo(i integer primary key, bar blob);

... then later does ...

update foo set bar=empty_blob() where i = <some key value>

The Oracle server on Solaris crashes. *the whole thing* BANG!
Shot-to-the-head-dead. Not the user's client - the server.

This means that any user with the right to update a single table with a
blob can crash Oracle at will.

What does this say about Oracle's overall reliability?

As Gavin says all software has bugs. Most of PG's bugs are far less
spectacular than the Oracle bug I mention here.

Overall I rate PG and Oracle as being about equivalent in terms of bugs.

--
Don Baccus
Portland, OR
http://donb.photo.net, http://birdnotes.net, http://openacs.org

In response to

Browse pgsql-committers by date

  From Date Subject
Next Message Andrew Sullivan 2002-08-12 14:31:29 Re: [COMMITTERS] pgsql-server/src backend/tcop/postgres.cbacke
Previous Message Tom Lane 2002-08-12 14:25:08 pgsql-server/src/pl/plpgsql/src pl_comp.c

Browse pgsql-hackers by date

  From Date Subject
Next Message Andrew Sullivan 2002-08-12 14:31:29 Re: [COMMITTERS] pgsql-server/src backend/tcop/postgres.cbacke
Previous Message Rod Taylor 2002-08-12 14:24:24 Re: Strange bahaviour