Here  http://www.sans.org/top20/#u9
are listed postgres vulnerability it's sad see that almost all
are related to third part components



Regards
Gaetano Mendola


Sat, 09 Oct 2004 21:27:00 +0200
Gaetano Mendola <mendola@bigfoot.com>
postgres vulnerability

On Sat, 9 Oct 2004, Gaetano Mendola wrote:

> Here  http://www.sans.org/top20/#u9
> are listed postgres vulnerability it's sad see that almost all
> are related to third part components

I'd go further than sad and say irresponsible for the ones that are like
that.

Sat, 9 Oct 2004 13:07:25 -0700 (PDT)
Stephan Szabo <sszabo@megazone.bigpanda.com>
Re: postgres vulnerability

On Sat, 9 Oct 2004, Stephan Szabo wrote:

>
> On Sat, 9 Oct 2004, Gaetano Mendola wrote:
>
> > Here  http://www.sans.org/top20/#u9
> > are listed postgres vulnerability it's sad see that almost all
> > are related to third part components
>
> I'd go further than sad and say irresponsible for the ones that are like
> that.

I should clarify as, irresponsible to be equating bugs in components that
use or misuse PostgreSQL with actual vulnerabilities in the database.

Sat, 9 Oct 2004 13:20:54 -0700 (PDT)
Stephan Szabo <sszabo@megazone.bigpanda.com>
Re: postgres vulnerability
Stephan Szabo wrote:
> On Sat, 9 Oct 2004, Stephan Szabo wrote:
> 
> 
>>On Sat, 9 Oct 2004, Gaetano Mendola wrote:
>>
>>
>>>Here  http://www.sans.org/top20/#u9
>>>are listed postgres vulnerability it's sad see that almost all
>>>are related to third part components
>>
>>I'd go further than sad and say irresponsible for the ones that are like
>>that.
> 
> 
> I should clarify as, irresponsible to be equating bugs in components that
> use or misuse PostgreSQL with actual vulnerabilities in the database.

Exactly this was my feeling.


Regards
Gaetano Mendola


Sat, 09 Oct 2004 22:30:28 +0200
Gaetano Mendola <mendola@bigfoot.com>
Re: postgres vulnerability
Gaetano Mendola wrote:
> Here  http://www.sans.org/top20/#u9
> are listed postgres vulnerability it's sad see that almost all
> are related to third part components

"Almost all"? By my count, 12 of the 17 vulnerabilities refer to 
legitimate problems in PostgreSQL, its RPM distribution, or the ODBC driver.

-Neil

Sun, 10 Oct 2004 14:02:00 +1000
Neil Conway <neilc@samurai.com>
Re: postgres vulnerability
Neil Conway <neilc@samurai.com> writes:
> Gaetano Mendola wrote:
>> Here  http://www.sans.org/top20/#u9
>> are listed postgres vulnerability it's sad see that almost all
>> are related to third part components

> "Almost all"? By my count, 12 of the 17 vulnerabilities refer to 
> legitimate problems in PostgreSQL, its RPM distribution, or the ODBC driver.

However, the ones that are still current (ie, something not fixed many
revs back) are mostly things outside our control.  I think the only
really serious charge in the lot is buffer overflows inside the ODBC
driver.

			regards, tom lane

Sun, 10 Oct 2004 00:25:52 -0400
Tom Lane <tgl@sss.pgh.pa.us>
Re: postgres vulnerability 
Neil Conway wrote:
 > Gaetano Mendola wrote:
 >
 >> Here  http://www.sans.org/top20/#u9
 >> are listed postgres vulnerability it's sad see that almost all
 >> are related to third part components
 >
 >
 > "Almost all"? By my count, 12 of the 17 vulnerabilities refer to
 > legitimate problems in PostgreSQL, its RPM distribution, or the ODBC
 > driver.

I consider RPM distribution and ODBC driver as third part component.

However doing a full scan :-)  on all bugs I widthraw "almost all".


Regards
Gaetano Mendola


Sun, 10 Oct 2004 11:13:27 +0200
Gaetano Mendola <mendola@bigfoot.com>
Re: postgres vulnerability
Gaetano Mendola wrote:
> Neil Conway wrote:
>  > Gaetano Mendola wrote:
>  >
>  >> Here  http://www.sans.org/top20/#u9
>  >> are listed postgres vulnerability it's sad see that almost all
>  >> are related to third part components
>  >
>  >
>  > "Almost all"? By my count, 12 of the 17 vulnerabilities refer to
>  > legitimate problems in PostgreSQL, its RPM distribution, or the ODBC
>  > driver.
> 
> I consider RPM distribution and ODBC driver as third part component.

Unless the vulnerability is introduced by a patch in the RPM, RPM is 
just a compiled version of the original. Thus, not third party code.

> However doing a full scan :-)  on all bugs I widthraw "almost all".

-- 
dave


Sun, 10 Oct 2004 18:07:54 +0700
David Garamond <lists@zara.6.isreserved.com>
Re: postgres vulnerability
David Garamond wrote:
> Gaetano Mendola wrote:
> 
>> Neil Conway wrote:
>>  > Gaetano Mendola wrote:
>>  >
>>  >> Here  http://www.sans.org/top20/#u9
>>  >> are listed postgres vulnerability it's sad see that almost all
>>  >> are related to third part components
>>  >
>>  >
>>  > "Almost all"? By my count, 12 of the 17 vulnerabilities refer to
>>  > legitimate problems in PostgreSQL, its RPM distribution, or the ODBC
>>  > driver.
>>
>> I consider RPM distribution and ODBC driver as third part component.
> 
> 
> Unless the vulnerability is introduced by a patch in the RPM, RPM is 
> just a compiled version of the original. Thus, not third party code.

Well the RPM issue was about wrong file permission, do you think this is 
a postgres vulnerability ?


Regards
Gaeatano Mendola



Sun, 10 Oct 2004 14:38:40 +0200
Gaetano Mendola <mendola@bigfoot.com>
Re: postgres vulnerability

On Sun, 10 Oct 2004, Neil Conway wrote:

> Gaetano Mendola wrote:
> > Here  http://www.sans.org/top20/#u9
> > are listed postgres vulnerability it's sad see that almost all
> > are related to third part components
>
> "Almost all"? By my count, 12 of the 17 vulnerabilities refer to
> legitimate problems in PostgreSQL, its RPM distribution, or the ODBC driver.

However, even removing "almost all" from the comment, it's still pretty
sad that a "trusted source for computer security training, certification
and research" would have a >25% miss rate on properly categorizing
vulnerabilities.

Sun, 10 Oct 2004 06:48:42 -0700 (PDT)
Stephan Szabo <sszabo@megazone.bigpanda.com>
Re: postgres vulnerability
Actually, I see this differently.

This is a classic example of how postgreSQL is viewed by the rest of the
world. This argument has been brought up before. 
It is only the core that differentiates the server from the interfaces.
The rest of the world views this as one product.

Dave
On Sun, 2004-10-10 at 09:48, Stephan Szabo wrote:
> On Sun, 10 Oct 2004, Neil Conway wrote:
> 
> > Gaetano Mendola wrote:
> > > Here  http://www.sans.org/top20/#u9
> > > are listed postgres vulnerability it's sad see that almost all
> > > are related to third part components
> >
> > "Almost all"? By my count, 12 of the 17 vulnerabilities refer to
> > legitimate problems in PostgreSQL, its RPM distribution, or the ODBC driver.
> 
> However, even removing "almost all" from the comment, it's still pretty
> sad that a "trusted source for computer security training, certification
> and research" would have a >25% miss rate on properly categorizing
> vulnerabilities.
> 
> ---------------------------(end of broadcast)---------------------------
> TIP 3: if posting/reading through Usenet, please send an appropriate
>       subscribe-nomail command to majordomo@postgresql.org so that your
>       message can get through to the mailing list cleanly
-- 
Dave Cramer
519 939 0336
ICQ # 14675561
www.postgresintl.com


Tue, 12 Oct 2004 12:33:58 -0400
Dave Cramer <pg@fastcrypt.com>
Re: postgres vulnerability

On Tue, 12 Oct 2004, Dave Cramer wrote:

> Actually, I see this differently.
>
> This is a classic example of how postgreSQL is viewed by the rest of the
> world. This argument has been brought up before.
> It is only the core that differentiates the server from the interfaces.
> The rest of the world views this as one product.

Some of the 5 remaining are things like mod_auth_pgsql or the auth module
for courier 0.40 that uses PostgreSQL as a backend.  I'm sorry, but I
really don't consider those part of PostgreSQL any more than I consider
any random piece of software that uses Oracle as a backend part of Oracle.

Tue, 12 Oct 2004 09:46:20 -0700 (PDT)
Stephan Szabo <sszabo@megazone.bigpanda.com>
Re: postgres vulnerability