5 ms·
Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls
by PinguTS 9y ago
Actually, the takeaway is not about updates. Because the problem is actual intended functionality, that is "misused" for other purposes: indirect function calls.
So, the takeaway would be to control, which functionality is needed and which not, then to take action accordingly.
- craigkerstiens 9y agoAh, yes. pl/c was the culprit it seems more than some other known vulnerability, updated original accordingly.
- cryptonector 9y agoWell, for one thing, inserting into pg_catalog tables without DDLs should require privilege and be audited. Secondly, things like lo_export() should be disabled by default.
- anarazel 9y ago> Well, for one thing, inserting into pg_catalog tables without DDLs should require privilege and be audited. It does require privileges. > Secondly, things like lo_export() should be disabled by default. It's superuser only.
- postila 9y agothings like superuser should be disabled by default (only DBA needs superuser access, not anybody else).