diff options
| author | Tom Lane <tgl@sss.pgh.pa.us> | 2013-04-01 14:00:51 -0400 |
|---|---|---|
| committer | Tom Lane <tgl@sss.pgh.pa.us> | 2013-04-01 14:00:51 -0400 |
| commit | 17fe2793ea7fe269ed616cb305150b6cf38dbaa8 (patch) | |
| tree | 1ae089183980d11e9776d1e73b9c81e9db09367c /src/backend/postmaster/postmaster.c | |
| parent | ce9ab88981495d975aade8fc664f99f68fc18e2b (diff) | |
| download | postgresql-17fe2793ea7fe269ed616cb305150b6cf38dbaa8.tar.gz postgresql-17fe2793ea7fe269ed616cb305150b6cf38dbaa8.zip | |
Fix insecure parsing of server command-line switches.
An oversight in commit e710b65c1c56ca7b91f662c63d37ff2e72862a94 allowed
database names beginning with "-" to be treated as though they were secure
command-line switches; and this switch processing occurs before client
authentication, so that even an unprivileged remote attacker could exploit
the bug, needing only connectivity to the postmaster's port. Assorted
exploits for this are possible, some requiring a valid database login,
some not. The worst known problem is that the "-r" switch can be invoked
to redirect the process's stderr output, so that subsequent error messages
will be appended to any file the server can write. This can for example be
used to corrupt the server's configuration files, so that it will fail when
next restarted. Complete destruction of database tables is also possible.
Fix by keeping the database name extracted from a startup packet fully
separate from command-line switches, as had already been done with the
user name field.
The Postgres project thanks Mitsumasa Kondo for discovering this bug,
Kyotaro Horiguchi for drafting the fix, and Noah Misch for recognizing
the full extent of the danger.
Security: CVE-2013-1899
Diffstat (limited to 'src/backend/postmaster/postmaster.c')
| -rw-r--r-- | src/backend/postmaster/postmaster.c | 9 |
1 files changed, 2 insertions, 7 deletions
diff --git a/src/backend/postmaster/postmaster.c b/src/backend/postmaster/postmaster.c index 15c23204611..298ad5e1ec4 100644 --- a/src/backend/postmaster/postmaster.c +++ b/src/backend/postmaster/postmaster.c @@ -3943,7 +3943,7 @@ BackendRun(Port *port) * from ExtraOptions is (strlen(ExtraOptions) + 1) / 2; see * pg_split_opts(). */ - maxac = 5; /* for fixed args supplied below */ + maxac = 2; /* for fixed args supplied below */ maxac += (strlen(ExtraOptions) + 1) / 2; av = (char **) MemoryContextAlloc(TopMemoryContext, @@ -3959,11 +3959,6 @@ BackendRun(Port *port) */ pg_split_opts(av, &ac, ExtraOptions); - /* - * Tell the backend which database to use. - */ - av[ac++] = port->database_name; - av[ac] = NULL; Assert(ac < maxac); @@ -3986,7 +3981,7 @@ BackendRun(Port *port) */ MemoryContextSwitchTo(TopMemoryContext); - PostgresMain(ac, av, port->user_name); + PostgresMain(ac, av, port->database_name, port->user_name); } |