"Feature" of PostgreSQL 9.3 could enable hackers to execute code; affects Mac, Windows, Linux

guest · Apr 1, 2019

"Feature" of PostgreSQL 9.3 could enable hackers to execute code; affects Mac, Windows, Linux
April 1, 2019
https://www.scmagazineuk.com/featur...ode-affects-mac-windows-linux/article/1580682

Security researchers have warned that a "feature" of PostgreSQL could allow certain database users to gain arbitrary code execution in the context of the user running the Postgres instance.

According to a blog post by security researcher Jacob Wilkin at Trustwave, the issue is enabled by default on all versions of PostgreSQL from 9.3 through to the latest of 11.2. It also affects all operating systems, Windows, Linux and Mac.

"This was patched and disabled by default in Microsoft SQL Server 2005, but it is interesting how the same bugs repeat, seemingly in cycles," said Wilkin.
Wilkin said that the bug is somewhere between a privilege escalation and an arbitrary code execution and needs some prior authentication.
Click to expand...

Wilkin said that while the feature is documented, it creates a security problem.

"xp_cmdshell is disabled for a reason. I understand that Postgres might want to keep the feature, however I believe it should not be enabled by default," he added in a comment on his personal blog.
Click to expand...

guest · Dec 11, 2020

Disputed PostgreSQL bug exploited in cryptomining botnet
December 11, 2020
https://www.computerweekly.com/news...stgreSQL-bug-exploited-in-cryptomining-botnet

A newly discovered Linux-based cryptocurrency mining botnet exploited a disputed remote code execution (RCE) vulnerability in PostgreSQL – first disclosed in 2018 and initially assigned CVE-2019-9193 – in order to compromise database servers and co-opt them into the mining network, researchers at Palo Alto Networks’ Unit 42 team say.

Dubbed PGMiner by the research team of Xiao Zhang, Yang Ji, Jim Fitzgerald, Yue Chen and Claud Xiao, the botnet is thought to be the first cryptomining botnet delivered via PostgreSQL ever to be detected. The team said it was notable that malicious actors had started to weaponise not just confirmed CVEs, but disputed ones.
Click to expand...

CVE-2019-9193 centres on the copy to/from program function which could allow superusers and users in the “ph_execute_server_program” group to execute arbitrary code in the context of the database’s operating system user – this functionality is enabled by default and could be abused to run arbitrary operating system (OS) commands on Windows, Linux and macOs.
However, according to PostgreSQL, this is not an issue because the functionality is working as intended.

“While this CVE is still being disputed, malware authors apparently have started to use it to stay under the detection radar by making the attack payload fileless.”
Note it is not currently detected by VirusTotal because the mining pool to which it attempted to connect is no longer active.
Click to expand...

Palo Alto Networks - Unit42: PGMiner: New Cryptocurrency Mining Botnet Delivered via PostgreSQL

While the underlying mining protocols and techniques remain fairly standard, malware actors tend to seek out and find smarter ways to hack into a victim’s machines.
Recently, Unit 42 researchers uncovered a novel Linux-based cryptocurrency mining botnet that exploits a disputed PostgreSQL remote code execution (RCE) vulnerability that compromises database servers for cryptojacking.
Click to expand...

Log in or Sign up

"Feature" of PostgreSQL 9.3 could enable hackers to execute code; affects Mac, Windows, Linux

guest Guest

guest Guest

Log in or Sign up

"Feature" of PostgreSQL 9.3 could enable hackers to execute code; affects Mac, Windows, Linux

guest Guest

guest Guest

Useful Searches