CVE-2009-3231

The core server component in PostgreSQL 8.3 before 8.3.8 and 8.2 before 8.2.14, when using LDAP authentication with anonymous binds, allows remote attackers to bypass authentication via an empty password.

Published: Sep 17, 2009
Updated: Nov 9, 2025
CVE: CVE-2009-3231
Severity: Medium
Exploit:

CVSS v2:

Severity: Medium
Score: 6.8
AV:N/AC:M/Au:N/C:P/I:P/A:P

CWEs:

CWE-287

OWASP TOP 10:

A2 - Broken Authentication

Affected Software
References

Software	From	Fixed in
postgresql / postgresql	8.2	8.2.14
postgresql / postgresql	8.3	8.3.8
suse / linux_enterprise_server	9	9.x
suse / linux_enterprise	11.0	11.0.x
opensuse / opensuse	10.3	11.1.x
suse / linux_enterprise	10.0-sp2	10.0-sp2.x
fedoraproject / fedora	11	11.x
fedoraproject / fedora	10	10.x
canonical / ubuntu_linux	9.04	9.04.x
canonical / ubuntu_linux	8.10	8.10.x
canonical / ubuntu_linux	8.04	8.04.x
canonical / ubuntu_linux	6.06	6.06.x

http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00001.html
http://lists.opensuse.org/opensuse-security-announce/2009-10/msg00004.html
http://marc.info/?l=bugtraq&m=134124585221119&w=2
http://secunia.com/advisories/36660
http://secunia.com/advisories/36727
http://secunia.com/advisories/36800
http://secunia.com/advisories/36837
http://wiki.rpath.com/wiki/Advisories:rPSA-2010-0012
http://www.postgresql.org/docs/8.3/static/release-8-3-8.html
http://www.postgresql.org/support/security.html
http://www.securityfocus.com/archive/1/509917/100/0/threaded
http://www.securityfocus.com/bid/36314
http://www.ubuntu.com/usn/usn-834-1
http://www.us.debian.org/security/2009/dsa-1900
https://bugzilla.redhat.com/show_bug.cgi?id=522084
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00305.html
https://www.redhat.com/archives/fedora-package-announce/2009-September/msg00307.html

Vulnerability Database

CVE-2009-3231

Deep Security Visibility Without the Complexity