Attacker Value

Unknown

(0 users assessed)

Exploitability

Unknown

(0 users assessed)

User Interaction

None

Privileges Required

Low

Attack Vector

Network

0

CVE-2012-3489

Disclosure Date: October 03, 2012 •

CVE-2012-3489 CVSS v3 Base Score: 6.5

MITRE ATT&CK

Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

The xml_parse function in the libxml2 support in the core server component in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 allows remote authenticated users to determine the existence of arbitrary files or URLs, and possibly obtain file or URL content that triggers a parsing error, via an XML value that refers to (1) a DTD or (2) an entity, related to an XML External Entity (aka XXE) issue.

Add Assessment

No one has assessed this topic. Be the first to add your voice to the community.

CVSS V3 Severity and Metrics

Data provided by the National Vulnerability Database (NVD)

Base Score:

6.5 Medium

Impact Score:

3.6

Exploitability Score:

2.8

Vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Attack Vector (AV):

Network

Attack Complexity (AC):

Low

Privileges Required (PR):

Low

User Interaction (UI):

None

Scope (S):

Unchanged

Confidentiality (C):

High

Integrity (I):

None

Availability (A):

None

Vendors

apple,
canonical,
debian,
opensuse,
postgresql,
redhat

Products

debian linux 6.0,
enterprise linux desktop 5.0,
enterprise linux desktop 6.0,
enterprise linux eus 6.3,
enterprise linux server 5.0,
enterprise linux server 6.0,
enterprise linux workstation 5.0,
enterprise linux workstation 6.0,
mac os x server,
mac os x server 10.6.8,
opensuse 11.4,
opensuse 12.1,
opensuse 12.2,
postgresql,
ubuntu linux 10.04,
ubuntu linux 11.04,
ubuntu linux 11.10,
ubuntu linux 12.04,
ubuntu linux 8.04

References

Canonical

CVE-2012-3489 (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-3489)

BID-55074 (http://www.securityfocus.com/bid/55074)

Advisory

http://rhn.redhat.com/errata/RHSA-2012-1263.html

http://www.postgresql.org/docs/9.0/static/release-9-0-9.html

http://www.mandriva.com/security/advisories?name=MDVSA-2012:139

USN-1542-1 (http://www.ubuntu.com/usn/USN-1542-1)

SECUNIA-50718 (http://secunia.com/advisories/50718)

http://www.postgresql.org/docs/9.1/static/release-9-1-5.html

https://blogs.oracle.com/sunsecurity/entry/multiple_vulnerabilities_in_postgresql2

http://www.postgresql.org/docs/8.4/static/release-8-4-13.html

http://www.postgresql.org/docs/8.3/static/release-8-3-20.html

http://www.postgresql.org/about/news/1407

SECUNIA-50635 (http://secunia.com/advisories/50635)

http://www.postgresql.org/support/security

APPLE-SA-2013-03-14-1 (http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html)

SECUNIA-50946 (http://secunia.com/advisories/50946)

https://bugzilla.redhat.com/show_bug.cgi?id=849173

DSA-2534 (http://www.debian.org/security/2012/dsa-2534)

http://lists.opensuse.org/opensuse-updates/2012-09/msg00102.html

http://lists.opensuse.org/opensuse-updates/2012-10/msg00013.html

SECUNIA-50859 (http://secunia.com/advisories/50859)

http://lists.opensuse.org/opensuse-updates/2012-10/msg00024.html

Rapid7

Technical Analysis