Use a separate interpreter for each calling SQL userid in plperl and pltcl.
There are numerous methods by which a Perl or Tcl function can subvert
the behavior of another such function executed later; for example, by
redefining standard functions or operators called by the target function.
If the target function is SECURITY DEFINER, or is called by such a
function, this means that any ordinary SQL user with Perl or Tcl language
usage rights can do essentially anything with the privileges of the target
function's owner.
To close this security hole, create a separate Perl or Tcl interpreter for
each SQL userid under which plperl or pltcl functions are executed within
a session. However, all plperlu or pltclu functions run within a session
still share a single interpreter, since they all execute at the trust
level of a database superuser anyway.
Note: this change results in a functionality loss when libperl has been
built without the "multiplicity" option: it's no longer possible to call
plperl functions under different userids in one session, since such a
libperl can't support multiple interpreters in one process. However, such
a libperl already failed to support concurrent use of plperl and plperlu,
so it's likely that few people use such versions with Postgres.
Security: CVE-2010-3433
Branch
------
REL8_0_STABLE
Details
-------
http://git.postgresql.org/gitweb?p=postgresql.git;a=commitdiff;h=8d7694b0d484382e67d3db0f41cc8ffefe4c9e1e
Modified Files
--------------
doc/src/sgml/installation.sgml | 5 +
doc/src/sgml/plperl.sgml | 59 +++-
doc/src/sgml/pltcl.sgml | 44 ++-
doc/src/sgml/release-7.4.sgml | 37 ++
doc/src/sgml/release-8.0.sgml | 37 ++
src/pl/plperl/plperl.c | 516 +++++++++++++++++-----------
src/pl/plperl/test/plperlu_plperl.expected | 18 +-
src/pl/plperl/test/test.expected | 2 +-
src/pl/tcl/pltcl.c | 343 +++++++++++--------
9 files changed, 675 insertions(+), 386 deletions(-)