* Technical Description *



Four vulnerabilities were reported in PostgreSQL, which may be exploited by an attacker to compromise a vulnerable system or obtain elevated privileges. These problems are due to several buffer overflow errors in the "PL/PgSQL" parser (gram.y), and can be exploited to execute arbitrary commands if :



- The "read_sql_construct" function handles a large number of variables in a SQL statement



- The "make_select_stmt" function handles a large number of INTO variables in a SELECT statement



- The "make_select_stmt" function handles large number of arbitrary variables in a SELECT statement



- The "make_fetch_stmt" function handles a large number of INTO variables in a FETCH statement



* Affected Products *



PostgreSQL version 8.0.1 and prior



* Solution *



http://developer.postgresql.org/cvsweb.cgi/pgsql/src/pl/plpgsql/src/gram.y.diff?r1=1.64.4.1&r2=1.64.4.2

http://developer.postgresql.org/cvsweb.cgi/pgsql/src/pl/plpgsql/src/gram.y.diff?r1=1.48.2.1&r2=1.48.2.2



* References *



http://archives.postgresql.org/pgsql-committers/2005-02/msg00049.php

http://archives.postgresql.org/pgsql-committers/2005-02/msg00050.php