diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2009-12-09 21:58:56 +0000 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2009-12-09 21:58:56 +0000 |
| commit | a3a262679e94641e848e3c04cbc18a3be0572c02 (patch) | |
| tree | f1c11d7726a1f631b5e1dbfe5c9b388ebcf9d2b1 /src/include/utils/guc_tables.h | |
| parent | e27495f3c9ac38b28a004177174039f0621980bf (diff) | |
Prevent indirect security attacks via changing session-local state within
an allegedly immutable index function. It was previously recognized that
we had to prevent such a function from executing SET/RESET ROLE/SESSION
AUTHORIZATION, or it could trivially obtain the privileges of the session
user. However, since there is in general no privilege checking for changes
of session-local state, it is also possible for such a function to change
settings in a way that might subvert later operations in the same session.
Examples include changing search_path to cause an unexpected function to
be called, or replacing an existing prepared statement with another one
that will execute a function of the attacker's choosing.
The present patch secures VACUUM, ANALYZE, and CREATE INDEX/REINDEX against
these threats, which are the same places previously deemed to need protection
against the SET ROLE issue. GUC changes are still allowed, since there are
many useful cases for that, but we prevent security problems by forcing a
rollback of any GUC change after completing the operation. Other cases are
handled by throwing an error if any change is attempted; these include temp
table creation, closing a cursor, and creating or deleting a prepared
statement. (In 7.4, the infrastructure to roll back GUC changes doesn't
exist, so we settle for rejecting changes of "search_path" in these contexts.)
Original report and patch by Gurjeet Singh, additional analysis by
Tom Lane.
Security: CVE-2009-4136
Diffstat (limited to 'src/include/utils/guc_tables.h')
| -rw-r--r-- | src/include/utils/guc_tables.h | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/include/utils/guc_tables.h b/src/include/utils/guc_tables.h index 83bd78b32d4..cd978484a75 100644 --- a/src/include/utils/guc_tables.h +++ b/src/include/utils/guc_tables.h @@ -7,7 +7,7 @@ * * Portions Copyright (c) 1996-2005, PostgreSQL Global Development Group * - * $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.19.4.2 2009/09/03 22:08:54 tgl Exp $ + * $PostgreSQL: pgsql/src/include/utils/guc_tables.h,v 1.19.4.3 2009/12/09 21:58:56 tgl Exp $ * *------------------------------------------------------------------------- */ @@ -127,7 +127,7 @@ struct config_generic #define GUC_SUPERUSER_ONLY 0x0100 /* show only to superusers */ #define GUC_IS_NAME 0x0200 /* limit string to NAMEDATALEN-1 */ -#define GUC_NOT_WHILE_SEC_DEF 0x8000 /* can't change inside sec-def func */ +#define GUC_NOT_WHILE_SEC_REST 0x8000 /* can't set if security restricted */ /* bit values in status field */ #define GUC_HAVE_TENTATIVE 0x0001 /* tentative value is defined */ |