Re: Zlib vulnerability heads-up.

Lamar Owen wrote:
> On Tuesday 12 March 2002 11:24 am, Trond Eivind Glomsrød wrote:
> > Lamar Owen <lamar(dot)owen(at)wgcr(dot)org> writes:
> > > Updating zlib is strongly recommended by many sources, and a patch is
> > > available.
>
> > FWIW, I really doubt this is much of a problem for postgresql. It's
> > mainly a problem for applications dealing with untrusted, compressed
> > data (webbrowsers, imageviewers, programs with skins downloaded from
> > the Internet) etc.
>
> It's probably NOT a big problem; but it IS a bug in an underlying library.

If fact, it isn't a problem at all. The only data any
PostgreSQL DBA would ever pump into a restore is something he
built himself or something he got from a secure source,
right? I mean, you don't feed some unknown script you found
on the net into the DB as the PostgreSQL superuser. In that
case, someone doesn't need to hand-craft such bad compressed
data, he can simply use the \! functionality of psql in his
script to do whatever he wants as user postgres.

Jan

--

#======================================================================#
# It's easier to get forgiveness for being wrong than for being right. #
# Let's break this rule - forgive me. #
#================================================== JanWieck(at)Yahoo(dot)com #

_________________________________________________________
Do You Yahoo!?
Get your free @yahoo.com address at http://mail.yahoo.com