Description
The bitsubstr function in backend/utils/adt/varbit.c in PostgreSQL 8.0.23, 8.1.11, and 8.3.8 allows remote authenticated users to cause a denial of service (daemon crash) or have unspecified other impact via vectors involving a negative integer in the third argument, as demonstrated by a SELECT statement that contains a call to the substring function for a bit string, related to an "overflow."
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 5.0 | postgresql-8.3 | 8.3.11-0lenny1 | DSA-2051-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 5 | postgresql +9 | 8.1.21-1.el5_5.1 | RHSA-2010:0429 |
| RHEL 4 | postgresql +10 | 7.4.29-1.el4_8.1 | RHSA-2010:0428 |
| RHEL 3 | rh-postgresql +10 | 7.3.21-3 | RHSA-2010:0427 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Exploit-DB 1
- PostgreSQL - 'bitsubstr' Buffer Overflow EDB-33571 · dos · Jan 27, 2010 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 4
- RHSA-2010:0429 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0428 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2010:0427 Red Hat Security Advisory: postgresql security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-2051-1 postgresql-8.3 - several Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2010:0427 vendor-advisory
- 1023510 vdb-entry
- RHSA-2010:0428 vendor-advisory
- DSA-2051 vendor-advisory
- USN-933-1 vendor-advisory
- 39820 third-party-advisory
- [oss-security] 20100127 Re: CVE id request: postgresql bitsubstr overflow mailing-list
- ADV-2010-1221 vdb-entry
- 37973 vdb-entry
- http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commit%3Bh=75dea10196c31d98d98c0bafeeb576ae99c09b12
- http://intevydis.blogspot.com/2010/01/postgresql-8023-bitsubstr-overflow.html
- http://git.postgresql.org/gitweb?p=postgresql.git%3Ba=commit%3Bh=b15087cb39ca9e4bde3c8920fcee3741045d2b83
- ADV-2010-1207 vdb-entry
- http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=567058
- ADV-2010-1022 vdb-entry
- [pgsql-hackers] 20100107 Re: Patch: Allow substring/replace() to get/set bit values mailing-list
- 39566 third-party-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=559259
- postgresql-substring-bo(55902) vdb-entry
- [pgsql-committers] 20100107 pgsql: Make bit/varbit substring() treat any negative length as meaning mailing-list
- RHSA-2010:0429 vendor-advisory
- oval:org.mitre.oval:def:9720 vdb-entry signature
- https://bugzilla.redhat.com/show_bug.cgi?id=559194
- MDVSA-2010:103 vendor-advisory
- 39939 third-party-advisory
- ADV-2010-1197 vdb-entry