cve-2008-3356
Vulnerability from cvelistv5
Published
2008-08-05 19:20
Modified
2024-08-07 09:37
Severity ?
Summary
verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.
References
cve@mitre.orghttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731
cve@mitre.orghttp://secunia.com/advisories/31357Vendor Advisory
cve@mitre.orghttp://secunia.com/advisories/31398
cve@mitre.orghttp://securitytracker.com/id?1020613
cve@mitre.orghttp://www.ingres.com/support/security-alert-080108.php
cve@mitre.orghttp://www.securityfocus.com/archive/1/495177/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/30512
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/2292
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/2313
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/44177
cve@mitre.orghttps://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989
af854a3a-2127-422b-91ae-364da2661108http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/31357Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/31398
af854a3a-2127-422b-91ae-364da2661108http://securitytracker.com/id?1020613
af854a3a-2127-422b-91ae-364da2661108http://www.ingres.com/support/security-alert-080108.php
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/495177/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/30512
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/2292
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/2313
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/44177
af854a3a-2127-422b-91ae-364da2661108https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989
Impacted products
Vendor Product Version
Show details on NVD website

To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-07T09:37:26.794Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ingres.com/support/security-alert-080108.php"
          },
          {
            "name": "ADV-2008-2292",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2292"
          },
          {
            "name": "31398",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31398"
          },
          {
            "name": "1020613",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://securitytracker.com/id?1020613"
          },
          {
            "name": "ADV-2008-2313",
            "tags": [
              "vdb-entry",
              "x_refsource_VUPEN",
              "x_transferred"
            ],
            "url": "http://www.vupen.com/english/advisories/2008/2313"
          },
          {
            "name": "31357",
            "tags": [
              "third-party-advisory",
              "x_refsource_SECUNIA",
              "x_transferred"
            ],
            "url": "http://secunia.com/advisories/31357"
          },
          {
            "name": "ingres-verifydb-symlink(44177)",
            "tags": [
              "vdb-entry",
              "x_refsource_XF",
              "x_transferred"
            ],
            "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44177"
          },
          {
            "name": "20080806 CA Products That Embed Ingres Multiple Vulnerabilities",
            "tags": [
              "mailing-list",
              "x_refsource_BUGTRAQ",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/archive/1/495177/100/0/threaded"
          },
          {
            "name": "30512",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/30512"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989"
          },
          {
            "name": "20080801 Ingres Database for Linux verifydb Insecure File Permissions Modification Vulnerability",
            "tags": [
              "third-party-advisory",
              "x_refsource_IDEFENSE",
              "x_transferred"
            ],
            "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "datePublic": "2008-08-01T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application\u0027s own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "n/a",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-10-11T19:57:01",
        "orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
        "shortName": "mitre"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ingres.com/support/security-alert-080108.php"
        },
        {
          "name": "ADV-2008-2292",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2292"
        },
        {
          "name": "31398",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31398"
        },
        {
          "name": "1020613",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://securitytracker.com/id?1020613"
        },
        {
          "name": "ADV-2008-2313",
          "tags": [
            "vdb-entry",
            "x_refsource_VUPEN"
          ],
          "url": "http://www.vupen.com/english/advisories/2008/2313"
        },
        {
          "name": "31357",
          "tags": [
            "third-party-advisory",
            "x_refsource_SECUNIA"
          ],
          "url": "http://secunia.com/advisories/31357"
        },
        {
          "name": "ingres-verifydb-symlink(44177)",
          "tags": [
            "vdb-entry",
            "x_refsource_XF"
          ],
          "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44177"
        },
        {
          "name": "20080806 CA Products That Embed Ingres Multiple Vulnerabilities",
          "tags": [
            "mailing-list",
            "x_refsource_BUGTRAQ"
          ],
          "url": "http://www.securityfocus.com/archive/1/495177/100/0/threaded"
        },
        {
          "name": "30512",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/30512"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989"
        },
        {
          "name": "20080801 Ingres Database for Linux verifydb Insecure File Permissions Modification Vulnerability",
          "tags": [
            "third-party-advisory",
            "x_refsource_IDEFENSE"
          ],
          "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "cve@mitre.org",
          "ID": "CVE-2008-3356",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "n/a",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "n/a"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application\u0027s own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "n/a"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "http://www.ingres.com/support/security-alert-080108.php",
              "refsource": "CONFIRM",
              "url": "http://www.ingres.com/support/security-alert-080108.php"
            },
            {
              "name": "ADV-2008-2292",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2292"
            },
            {
              "name": "31398",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31398"
            },
            {
              "name": "1020613",
              "refsource": "SECTRACK",
              "url": "http://securitytracker.com/id?1020613"
            },
            {
              "name": "ADV-2008-2313",
              "refsource": "VUPEN",
              "url": "http://www.vupen.com/english/advisories/2008/2313"
            },
            {
              "name": "31357",
              "refsource": "SECUNIA",
              "url": "http://secunia.com/advisories/31357"
            },
            {
              "name": "ingres-verifydb-symlink(44177)",
              "refsource": "XF",
              "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/44177"
            },
            {
              "name": "20080806 CA Products That Embed Ingres Multiple Vulnerabilities",
              "refsource": "BUGTRAQ",
              "url": "http://www.securityfocus.com/archive/1/495177/100/0/threaded"
            },
            {
              "name": "30512",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/30512"
            },
            {
              "name": "https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989",
              "refsource": "CONFIRM",
              "url": "https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989"
            },
            {
              "name": "20080801 Ingres Database for Linux verifydb Insecure File Permissions Modification Vulnerability",
              "refsource": "IDEFENSE",
              "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
    "assignerShortName": "mitre",
    "cveId": "CVE-2008-3356",
    "datePublished": "2008-08-05T19:20:00",
    "dateReserved": "2008-07-28T00:00:00",
    "dateUpdated": "2024-08-07T09:37:26.794Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ingres:ingres:2.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DCE11A92-56B9-43A2-9E3D-D511AE713F45\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ingres:ingres:2006:9.0.1:*:*:*:*:*:*\", \"matchCriteriaId\": \"8CEFDCDD-7D4B-442C-8CD4-D22CA5F4DD35\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ingres:ingres:2006:9.0.4:*:*:*:*:*:*\", \"matchCriteriaId\": \"D988634E-4C81-457B-AA97-9C55575E9DB6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ingres:ingres:2006:release_1:*:*:*:*:*:*\", \"matchCriteriaId\": \"A99FF96C-A88B-4AE2-BA8B-C16D2F88C606\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:ingres:ingres:2006:release_2:*:*:*:*:*:*\", \"matchCriteriaId\": \"02D8FAC9-5887-4B0D-BB95-0704D763B6A8\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application\u0027s own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.\"}, {\"lang\": \"es\", \"value\": \"verifydb en Ingres 2.6, Ingres 2006 versi\\u00f3n 1 (alias 9.0.4), y Ingres 2006 versi\\u00f3n 2 (alias 9.1.0) en Linux y otras plataformas Unix que establece la propiedad o permisos del archivo iivdb.log, sin verificar que es el archivo log propio de la aplicaci\\u00f3n, lo que permite a los usuarios sobrescribir arbitrariamente archivos creando un enlace simb\\u00f3lico con un nombre de archivo iivdb.log.\"}]",
      "evaluatorComment": "This vulnerability affects all platforms except VMS and Windows",
      "evaluatorImpact": "\"Exploitation of this vulnerability allows an attacker to overwrite arbitrary files owned by the \"ingres\" user. By itself, this vulnerability does not have very serious consequences. However, when combined with the library loading vulnerability, it allows an attacker to execute arbitrary code with root privileges. \" (iDefense)\r\n\r\n",
      "evaluatorSolution": "Fixes are available for the current release of Ingres 2006 release 2 (9.1.0), for Ingres 2006 release 1 (9.0.4), and for Ingres 2.6 versions on their respective platforms. The security fixes are available and can be quickly applied with little to no anticipated impact to systems. \r\n\r\nIngres customers with a current support contract can review the following knowledge base document for information on downloading the available fixes:\r\nhttp://servicedesk.ingres.com/CAisd/pdmweb.ingres?OP=SHOW_DETAIL+PERSID=KD:416012+HTMPL=kt_document_view.htmpl\r\n\r\n(ingres.com)",
      "id": "CVE-2008-3356",
      "lastModified": "2024-11-21T00:49:03.210",
      "metrics": "{\"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:L/AC:L/Au:N/C:P/I:P/A:P\", \"baseScore\": 4.6, \"accessVector\": \"LOCAL\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"PARTIAL\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 3.9, \"impactScore\": 6.4, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": true, \"userInteractionRequired\": false}]}",
      "published": "2008-08-05T19:41:00.000",
      "references": "[{\"url\": \"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://secunia.com/advisories/31357\", \"source\": \"cve@mitre.org\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/31398\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://securitytracker.com/id?1020613\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.ingres.com/support/security-alert-080108.php\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/archive/1/495177/100/0/threaded\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.securityfocus.com/bid/30512\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.vupen.com/english/advisories/2008/2292\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://www.vupen.com/english/advisories/2008/2313\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/44177\", \"source\": \"cve@mitre.org\"}, {\"url\": \"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989\", \"source\": \"cve@mitre.org\"}, {\"url\": \"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://secunia.com/advisories/31357\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"http://secunia.com/advisories/31398\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://securitytracker.com/id?1020613\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.ingres.com/support/security-alert-080108.php\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/archive/1/495177/100/0/threaded\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.securityfocus.com/bid/30512\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vupen.com/english/advisories/2008/2292\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://www.vupen.com/english/advisories/2008/2313\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://exchange.xforce.ibmcloud.com/vulnerabilities/44177\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
      "sourceIdentifier": "cve@mitre.org",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-264\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2008-3356\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2008-08-05T19:41:00.000\",\"lastModified\":\"2024-11-21T00:49:03.210\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application\u0027s own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.\"},{\"lang\":\"es\",\"value\":\"verifydb en Ingres 2.6, Ingres 2006 versi\u00f3n 1 (alias 9.0.4), y Ingres 2006 versi\u00f3n 2 (alias 9.1.0) en Linux y otras plataformas Unix que establece la propiedad o permisos del archivo iivdb.log, sin verificar que es el archivo log propio de la aplicaci\u00f3n, lo que permite a los usuarios sobrescribir arbitrariamente archivos creando un enlace simb\u00f3lico con un nombre de archivo iivdb.log.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:L/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":4.6,\"accessVector\":\"LOCAL\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":3.9,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":true,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-264\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ingres:ingres:2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCE11A92-56B9-43A2-9E3D-D511AE713F45\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ingres:ingres:2006:9.0.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"8CEFDCDD-7D4B-442C-8CD4-D22CA5F4DD35\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ingres:ingres:2006:9.0.4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D988634E-4C81-457B-AA97-9C55575E9DB6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ingres:ingres:2006:release_1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A99FF96C-A88B-4AE2-BA8B-C16D2F88C606\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ingres:ingres:2006:release_2:*:*:*:*:*:*\",\"matchCriteriaId\":\"02D8FAC9-5887-4B0D-BB95-0704D763B6A8\"}]}]}],\"references\":[{\"url\":\"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://secunia.com/advisories/31357\",\"source\":\"cve@mitre.org\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/31398\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://securitytracker.com/id?1020613\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.ingres.com/support/security-alert-080108.php\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/archive/1/495177/100/0/threaded\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/30512\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/2292\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/2313\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/44177\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/31357\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/31398\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://securitytracker.com/id?1020613\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ingres.com/support/security-alert-080108.php\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/archive/1/495177/100/0/threaded\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/30512\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/2292\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.vupen.com/english/advisories/2008/2313\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/44177\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}],\"evaluatorComment\":\"This vulnerability affects all platforms except VMS and Windows\",\"evaluatorSolution\":\"Fixes are available for the current release of Ingres 2006 release 2 (9.1.0), for Ingres 2006 release 1 (9.0.4), and for Ingres 2.6 versions on their respective platforms. The security fixes are available and can be quickly applied with little to no anticipated impact to systems. \\r\\n\\r\\nIngres customers with a current support contract can review the following knowledge base document for information on downloading the available fixes:\\r\\nhttp://servicedesk.ingres.com/CAisd/pdmweb.ingres?OP=SHOW_DETAIL+PERSID=KD:416012+HTMPL=kt_document_view.htmpl\\r\\n\\r\\n(ingres.com)\",\"evaluatorImpact\":\"\\\"Exploitation of this vulnerability allows an attacker to overwrite arbitrary files owned by the \\\"ingres\\\" user. By itself, this vulnerability does not have very serious consequences. However, when combined with the library loading vulnerability, it allows an attacker to execute arbitrary code with root privileges. \\\" (iDefense)\\r\\n\\r\\n\"}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.