Bug 407549 – <dev-perl/DBD-Pg-2.19.0 : two format string vulnerabilities (CVE-2012-1151)

• Status: RESOLVED FIXED
• Product: Gentoo Security

[Description Agostino Sarubbo 2012-03-09 15:09:31 UTC]

From secunia security advisory at $URL:

Description:
1) A format string error exists within the "pg_warn()" function (dbdimp.c) when handling database notices.

2) A format string error exists within the "dbd_st_prepare()" function (dbdimp.c) when preparing DBD statements.

Successful exploitation of the vulnerabilities may allow execution of arbitrary code but requires connecting to a malicious database server.

The vulnerabilities are reported in version 2.18.1. Other versions may also be affected.


Solution
Do not connect to untrusted database servers.

[Comment 1 Torsten Veller (RETIRED) 2012-03-10 09:14:23 UTC]

2.19.0 is in the tree.

+Version 2.19.0  Released March 9, 2012                                                                   
+                                                                                                         
+  - Use proper formatting for warn() and croak() (CPAN bug #75642)                                       
+    [Niko Tyni]

[Comment 2 Agostino Sarubbo 2012-03-10 09:22:41 UTC]

(In reply to comment #1)
> 2.19.0 is in the tree.

Thanks,

Arches, please test and mark stable:
=dev-perl/DBD-Pg-2.19.0
Target KEYWORDS : "alpha amd64 arm hppa ia64 ppc ppc64 s390 sh sparc x86"

[Comment 3 Brent Baude (RETIRED) 2012-03-10 17:08:04 UTC]

ppc done

[Comment 4 Mikle Kolyada (RETIRED) 2012-03-11 11:53:50 UTC]

x86: ok

[Comment 5 Brent Baude (RETIRED) 2012-03-11 13:52:41 UTC]

ppc64 done

[Comment 6 Agostino Sarubbo 2012-03-11 15:38:34 UTC]

amd64 stable

[Comment 7 Paweł Hajdan, Jr. (RETIRED) 2012-03-12 14:45:45 UTC]

x86 stable

[Comment 8 Jeroen Roovers (RETIRED) 2012-03-13 11:42:18 UTC]

Stable for HPPA.

[Comment 9 Raúl Porcel (RETIRED) 2012-03-17 17:36:07 UTC]

alpha/arm/ia64/s390/sh/sparc stable

[Comment 10 Sean Amoss (RETIRED) 2012-03-17 18:53:04 UTC]

Thanks, everyone.

Filing new GLSA request.

[Comment 11 Tim Sammut (RETIRED) 2012-04-05 21:15:18 UTC]

Ago, is CVE-2012-1152 correct here? Looks like it should be against dev-perl/YAML-LibYAML?

http://www.openwall.com/lists/oss-security/2012/03/10/4

[Comment 12 Agostino Sarubbo 2012-04-05 21:23:01 UTC]

(In reply to comment #11)
> Ago, is CVE-2012-1152 correct here? Looks like it should be against
> dev-perl/YAML-LibYAML?
> 
> http://www.openwall.com/lists/oss-security/2012/03/10/4

should be ok now :)

[Comment 13 GLSAMaker/CVETool Bot 2012-04-17 23:49:06 UTC]

This issue was resolved and addressed in
 GLSA 201204-08 at http://security.gentoo.org/glsa/glsa-201204-08.xml
by GLSA coordinator Sean Amoss (ackle).

[Comment 14 GLSAMaker/CVETool Bot 2012-09-10 11:38:05 UTC]

CVE-2012-1151 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-1151):
  Multiple format string vulnerabilities in dbdimp.c in DBD::Pg (aka DBD-Pg or
  libdbd-pg-perl) module before 2.19.0 for Perl allow remote PostgreSQL
  database servers to cause a denial of service (process crash) via format
  string specifiers in (1) a crafted database warning to the pg_warn function
  or (2) a crafted DBD statement to the dbd_st_prepare function.