CVE-2015-5288

What it actually does

The crypt function in pgcrypto accepts an insufficiently long salt value, triggering a crash or allowing out-of-bounds memory reads that expose server process memory contents over the network.

Why it matters to the business

Unpatched PostgreSQL servers can be crashed remotely or have sensitive memory contents disclosed, leading to service outages and potential exposure of credentials or other in-memory data without authentication.

How an attack unfolds

An attacker connects to a PostgreSQL instance exposing pgcrypto and supplies a crypt call with a deliberately short salt; the server either terminates or returns portions of its memory, which the attacker can repeat to gather useful data.

How to fix it

Upgrade PostgreSQL to 9.0.23, 9.1.19, 9.2.14, 9.3.10 or 9.4.5 (or later) and restart affected instances; if immediate upgrade is impossible, disable or remove the pgcrypto contrib module.

How to confirm the fix worked

Confirm the running PostgreSQL version is at or above the fixed releases listed above; test that crypt() calls with short salts no longer crash the server or return memory contents.

Typical attack path

1. Identify an exposed PostgreSQL service accepting connections
2. Issue a crafted crypt() call via pgcrypto with a too-short salt
3. Observe server crash (DoS) or receive leaked memory bytes
4. Repeat or analyze returned memory for sensitive information

How to detect it

Review PostgreSQL server logs for sudden crashes or errors originating from the pgcrypto module; correlate with network connections that include crypt() function calls containing unusually short salt values.

What your security team should do

• Apply the listed version upgrades immediately on all PostgreSQL deployments
• Scan for any remaining instances still running pre-fix versions
• Review application code for direct use of pgcrypto crypt() and add input validation on salt length as a defense-in-depth measure