Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in - Mailing list pgsql-hackers

From Justin Clift
Subject Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in
Date
Msg-id 3D61BA26.D97FBE91@postgresql.org
Whole thread Raw
In response to Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in  ("Christopher Kings-Lynne" <chriskl@familyhealth.com.au>)
Responses Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in
Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in
List pgsql-hackers
Tom Lane wrote:
> 
> Justin Clift <justin@postgresql.org> writes:
> > Hang on, you seem to be suggesting we release a major new upgrade, with
> > major new functionality, knowing it contains a way to trivially crash
> > the backend.
> 
> This particular hole has been in *every* release since Postgres 1.01.

How many releases have we known about this and still done a major
release?
> I'm really not interested in responding to any argument that we cannot
> release 7.3 until we have fixed everything that could be labeled a DOS
> threat.  7.3 already contains a bunch of bug fixes; shall we postpone
> releasing those because there are other unfixed bugs?

How trivial are they to exploit?

For example, thinking about something like the various ISP's around who
host PostgreSQL databases; how much effort would it take to fix the
vulnerabilities that let someone with remote access, but no ability to
run a "trusted" language, take out the backend?

Regards and best wishes,

Justin Clift
>                         regards, tom lane

-- 
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."  - Indira Gandhi


pgsql-hackers by date:

Previous
From: Tom Lane
Date:
Subject: Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in
Next
From: Tom Lane
Date:
Subject: Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in