On Wed, Mar 27, 2013 at 10:16 AM, Heikki Linnakangas
<hlinnakangas@vmware.com> wrote:
> I'm quite worried about the security ramifications of this patch. Today, if
> you're not sure if a system has e.g sslinfo installed, you can safely just
> run "CREATE EXTENSION sslinfo". With this patch, that's no longer true,
> because "foo" might not be the extension you're looking for. Mallory
> might've done this:
>
> create template for extension sslinfo version '1.0' with (schema public) as
> $$ DO EVIL STUFF $$;
Surely creating an extension template must be a superuser-only
operation, in which case this is an issue because Mallory could also
have just blown up the world directly if he's already a superuser
anyway.
If the current patch isn't enforcing that, it's 100% broken.
--
Robert Haas
EnterpriseDB: http://www.enterprisedb.com
The Enterprise PostgreSQL Company