Hacker News new | ask | show | jobs
by mark_l_watson 4821 days ago
I would like an answer to this, quickly, also. I am scheduled to leave on a 6 hour hike in one hour - I have time to update if I have to. I only permit localhost connections.
2 comments
Intermernet 4821 days ago
Do it, it involves about 3 seconds of downtime per server to run sudo aptitide update and sudo aptitude upgrade . Other package management tools should be equally speedy. If you've rolled your own postgresql binary, get the new sources, re-build, stop services, replace binaries, start services (the old drill...)

The upgrade (on Debian based systems at least) is for libpq5, postgresql-9.1 and postgresql-client-9.1 . You shouldn't need to do anything else unless, for some strange reason, you actually do have a database starting with "-".

Also, I wish you a fine hike!

(probably commented too late, but I hope you had a nice hike, nonetheless)

link
talkingquickly 4821 days ago
From the FAQ:

Who is most at risk:

"Any system that allows unrestricted access to the PostgreSQL network port, such as users running PostgreSQL on a public cloud, is especially vulnerable. Users whose servers are only accessible on protected internal networks, or who have effective firewalling or other network access restrictions, are less vulnerable."

So looks like it's low risk but they're not willing to say no risk.

link
vidarh 4821 days ago
The reason they are not willing to say no risk is presumably that if you don't upgrade, then any other security vulnerability that allows an attacker to trigger a network connection with a suitable payload to port 5432 (or any other ports you may have Postgres on) on your hosts could still be harmful.

That means anything that gives local shell as any user that run normal tools, but potentially also a lot of other things.

E.g. any software that can be tricked to try to connect to a local address/port pair and send a suitable string.

That dramatically escalates any minor little hole that might otherwise not be a risk for you.

(That's a reminder to always verify before trusting any hostname/IP a user passes you that it's not a local address or address you have privileged access to, and to also consider internally firewalling connections between your various hosts down to just what you need)

link