Re: [SECURITY] DoS attack on backend possible (was: Re:

Christopher Kings-Lynne wrote:
> 
> > Hey yep, good point.
> >
> > Is this the only way that we know of non postgresql-superusers to be
> > able to take out the server other than by extremely non-optimal,
> > resource wasting queries?
> >
> > If we release a 7.2.2 because of this, can we be pretty sure we have a
> > "no known vulnerabilities" release, or are there other small holes which
> > should be fixed too?
> 
> What about that "select cash_out(2) crashes because of opaque" entry in the
> TODO?  That really needs to be fixed.
> 
> I was talking to a CS lecturer about switching to postgres from oracle when
> 7.3 comes out and all he said was "how easily is it hacked?".  He says their
> systems are the most constantly bombarded in universities.  What could I
> say?  That any unprivileged user can just go 'select cash_out(2)' to DOS the
> backend?

If he's using Oracle already, he ought to check out:

http://www.cert.org/advisories/CA-2002-08.html

I'd still think it would be a good policy to make a security release.
However, without user resource limits in PostgreSQL, anyone can make a
machine useless with a query like:

SELECT * 
FROM pg_class a, pg_class b, pg_class c, pg_class d, pg_class e, ... ;

Mike Mascari
mascarm@mascari.com