Re: @(#) Mordred Labs advisory 0x0001: Buffer overflow in

Tom Lane wrote:
>
> Justin Clift <justin(at)postgresql(dot)org> writes:
> > Hang on, you seem to be suggesting we release a major new upgrade, with
> > major new functionality, knowing it contains a way to trivially crash
> > the backend.
>
> This particular hole has been in *every* release since Postgres 1.01.

How many releases have we known about this and still done a major
release?

> I'm really not interested in responding to any argument that we cannot
> release 7.3 until we have fixed everything that could be labeled a DOS
> threat. 7.3 already contains a bunch of bug fixes; shall we postpone
> releasing those because there are other unfixed bugs?

How trivial are they to exploit?

For example, thinking about something like the various ISP's around who
host PostgreSQL databases; how much effort would it take to fix the
vulnerabilities that let someone with remote access, but no ability to
run a "trusted" language, take out the backend?

Regards and best wishes,

Justin Clift

> regards, tom lane

--
"My grandfather once told me that there are two kinds of people: those
who work and those who take the credit. He told me to try to be in the
first group; there was less competition there."
- Indira Gandhi