Skip site navigation (1) Skip section navigation (2)

Re: [HACKERS] Hacker found bug in Postgres ?

From: Tom Lane <tgl(at)sss(dot)pgh(dot)pa(dot)us>
To: Matthias Schmitt <freak001(at)mmp(dot)lu>
Cc: pgsql-hackers(at)postgreSQL(dot)org
Subject: Re: [HACKERS] Hacker found bug in Postgres ?
Date: 1999-04-28 06:00:08
Message-ID: (view raw, whole thread or download thread mbox)
Lists: pgsql-hackers
Matthias Schmitt <freak001(at)mmp(dot)lu> writes:
> this night we discovered here a strange behaviour on our servers. Somebody
> managed to get access to the UNIX shell using the 'postgres' db
> administrator account. He logged in some machines with a single try !

Ugh.  Depressing news, if accurate.  But you should not rule out the
possibility that the security failure was elsewhere.

What version of Postgres are you running?  (6.4 and later are inherently
more secure than prior releases, since they don't do an exec() while
forking a backend server process.)

After a few minutes' thought, the only attack paths that come to mind
require access to postgres superuser rights.  (For example, "COPY TO
filename" could potentially overwrite any file writable by the postgres
userid, but that operation is only allowed to a database user who's
logged in as the postgres superuser.)  Do you have access permissions
set up to ensure that an unguessable password must be supplied to
log into Postgres as superuser?

As a short-term defense until you know exactly what happened, I'd
suggest modifying Postgres' pg_hba.conf file to restrict access
as much as possible.  In particular the Postgres superuser should
only be allowed to log in from trustworthy local machines.

			regards, tom lane

pgsql-hackers by date

Next:From: Brook MilliganDate: 1999-04-28 06:54:45
Subject: rules bug?
Previous:From: Hiroshi InoueDate: 1999-04-28 05:42:10
Subject: RE: [HACKERS] Lock freeze ? in MVCC

Privacy Policy | About PostgreSQL
Copyright © 1996-2017 The PostgreSQL Global Development Group