Vulnerability Details : CVE-2006-5540
backend/parser/analyze.c in PostgreSQL 8.1.x before 8.1.5 allows remote authenticated users to cause a denial of service (daemon crash) via certain aggregate functions in an UPDATE statement, which are not properly handled during a "MIN/MAX index optimization."
Vulnerability category: Denial of service
Products affected by CVE-2006-5540
- cpe:2.3:a:postgresql:postgresql:6.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:6.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.2.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.11:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.14:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.12:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.4.13:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.3.15:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:8.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:postgresql:postgresql:7.0.2:*:*:*:*:*:*:*
Threat overview for CVE-2006-5540
Top countries where our scanners detected CVE-2006-5540
Top open port discovered on systems with this issue
5432
IPs affected by CVE-2006-5540 2,740
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2006-5540!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2006-5540
2.36%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 90 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2006-5540
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.0
|
MEDIUM | AV:N/AC:L/Au:S/C:N/I:N/A:P |
8.0
|
2.9
|
NIST |
References for CVE-2006-5540
-
http://www.redhat.com/support/errata/RHSA-2007-0067.html
Support
-
http://projects.commandprompt.com/public/pgsql/changeset/25504
-
http://securitytracker.com/id?1017115
-
http://www.novell.com/linux/security/advisories/2006_27_sr.html
404 Page Not Found | SUSE
-
http://support.avaya.com/elmodocs2/security/ASA-2007-117.htm
ASA-2007-117 (RHSA-2007-0067)
-
http://www.redhat.com/support/errata/RHSA-2007-0068.html
Support
-
http://www.postgresql.org/about/news.664
PostgreSQL: Not Found
-
http://www.trustix.org/errata/2006/0059/
Trustix | Empowering Trust and Security in the Digital Age
-
http://support.novell.com/techcenter/psdb/59650c03a8bc5ae310cd7898bd106ad2.html
Security update for PostgreSQL
-
http://www.ubuntu.com/usn/usn-369-1
USN-369-1: PostgreSQL vulnerabilities | Ubuntu security notices | Ubuntu
-
http://www.redhat.com/support/errata/RHSA-2007-0064.html
-
http://www.mandriva.com/security/advisories?name=MDKSA-2006:194
Page not found - Mandriva.com
-
http://www.ubuntu.com/usn/usn-369-2
USN-369-2: postgresql-8.1 vulnerabilities | Ubuntu security notices | Ubuntu
-
http://www.securityfocus.com/bid/20717
Patch
-
http://www.vupen.com/english/advisories/2006/4182
Webmail: access your OVH emails on ovhcloud.com | OVHcloud
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11425
-
ftp://patches.sgi.com/support/free/security/advisories/20070201-01-P.asc
Jump to