start-scripts: switch to $PGUSER before opening $PGLOG. By default, $PGUSER has permission to unlink $PGLOG. If $PGUSER replaces $PGLOG with a symbolic link, the server will corrupt the link-targeted file by appending log messages. Since these scripts open $PGLOG as root, the attack works regardless of target file ownership.
"make install" does not install these scripts anywhere. Users having manually installed them in the past should repeat that process to acquire this fix. Most script users have $PGLOG writable to root only, located in $PGDATA. Just before updating one of these scripts, such users should rename $PGLOG to $PGLOG.old. The script will then recreate $PGLOG with proper ownership. Reviewed by Peter Eisentraut. Reported by Antoine Scemama. Security: CVE-2017-12172 Branch ------ REL9_5_STABLE Details ------- https://git.postgresql.org/pg/commitdiff/ed546dd06195c27d92ae46f2bb1a74261bcb49e6 Modified Files -------------- contrib/start-scripts/freebsd | 4 ++-- contrib/start-scripts/linux | 4 ++-- contrib/start-scripts/osx/PostgreSQL | 8 ++++---- 3 files changed, 8 insertions(+), 8 deletions(-) -- Sent via pgsql-committers mailing list (pgsql-committers@postgresql.org) To make changes to your subscription: http://www.postgresql.org/mailpref/pgsql-committers
