CVE-2016-1255

What it actually does

The pg_ctlcluster script follows symlinks when writing to logfiles in /var/log/postgresql without validation, allowing a local user to redirect output to arbitrary files and thereby overwrite privileged content.

Why it matters to the business

Local attackers on affected Debian and Ubuntu systems can obtain full root access, leading to complete compromise of database servers, data theft, service disruption, and potential lateral movement within the environment.

How an attack unfolds

An attacker with local access creates a symlink from the postgresql logfile path to a sensitive target such as /etc/passwd or a cron script, then triggers pg_ctlcluster so the script writes attacker-controlled content through the link, achieving root privilege escalation.

How to fix it

Upgrade postgresql-common to a fixed version: Debian wheezy to 134wheezy5 or later, jessie to 165+deb8u2 or later, unstable to 178 or later; Ubuntu 12.04 to 129ubuntu1.2 or later, 14.04 to 154ubuntu1.1 or later, 16.04 to 173ubuntu0.1 or later, 17.04 to 179ubuntu0.1 or later, 17.10 to 184ubuntu1.1 or later. Restrict write access to /var/log/postgresql until patches are applied.

How to confirm the fix worked

Confirm the installed postgresql-common package version meets or exceeds the listed fixed releases for the distribution, then test that pg_ctlcluster operations no longer follow symlinks into protected directories.

Typical attack path

1. Obtain local shell access on a vulnerable system
2. Create a symlink from /var/log/postgresql/*.log to a privileged target file
3. Invoke pg_ctlcluster or wait for a scheduled cluster operation
4. Verify the target file has been overwritten with attacker data
5. Escalate to root via the modified privileged file

How to detect it

Review system logs and file integrity data for unexpected modifications to files in /etc, /root, or cron directories around the time pg_ctlcluster or postgresql service restarts occurred; inspect /var/log/postgresql for symlinks created by non-root users.

• /var/log/postgresql/*.log -> /etc/passwd
• /var/log/postgresql/*.log -> /etc/shadow
• pg_ctlcluster process writing through symlink
• Unexpected changes to /etc/cron.d or /root/.bashrc coinciding with postgresql logs

What your security team should do

• Immediately patch postgresql-common on all Debian and Ubuntu systems to the fixed package versions
• Audit local user accounts and remove unnecessary sudo or postgres group memberships
• Monitor /var/log/postgresql for unexpected symlink creations or permission changes
• Harden logfile directory permissions to prevent symlink planting by non-root users