|
Ingres Database Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA25756
|
|
|
Release Date:
|
2007-06-22
|
|
Last Update:
|
2007-06-26
|
|
Popularity:
|
6,043 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Manipulation of data
System access
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Ingres 2.x
Ingres 2006 (9.x)
Ingres 3.x
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities 
|
|
| CVE reference: | CVE-2007-3334
CVE-2007-3336
CVE-2007-3337
CVE-2007-3338
|
|
Description:
Multiple vulnerabilities have been reported in Ingres, which can be exploited by malicious people to truncate a certain file or compromise a vulnerable system.
1) Boundary errors within the Communications Server (iigcc.exe) and Data Access Server (iigcd.exe) can be exploited to cause heap-based buffer overflows by sending overly long, specially-crafted requests to port 10916/TCP (iigcc.exe) or 10923/TCP (iigcd.exe).
2) The problem is that the QUremove and QUinsert functions in the Ingres Communications Server Process (igcc) can be exploited to overwrite an address, which is controlled by the attacker, via sending specially-crafted series of packets to default port 21064/TCP.
3) A boundary error within "uuid_from_char()" can be exploited to cause a stack-based buffer overflow by passing an overly long string as argument.
4) A boundary error in the duve_get_args function within duveutil.c when the Ingres verifydb utility parses command-line arguments can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted argument.
5) The "wakeup" binary, which creates a file named "alarmwkp.def" in the current directory and truncates it if it exists, can be exploited to truncate an arbitrary file with the privileges of the "ingres" user via a symbolic link.
The vulnerabilities affect the following versions:
* Ingres 2006 (version 9.0.4)
* Ingres r3
* Ingres 2.6
* Ingres 2.5
Solution:
Apply patches. Please see the vendor's advisory for details.
Provided and/or discovered by:
1) Discovered by an anonymous person and reported via iDefense Labs.
2-5) Chris Anley, NGSSoftware, Ltd.
Changelog:
2007-06-25: Added additional link and CVE references.
2007-06-26: Updated description and added additional links.
Original Advisory:
CA/Ingres:
http://supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp
iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=546
Ingres (requires login):
http://servicedesk.ingres.com/CAisd/p...D:415738+HTMPL=kt_document_view.htmpl
NGSSoftware:
http://www.ngssoftware.com/advisories...nerability-in-ingres-file-truncation/
http://www.ngssoftware.com/advisories...lnerability-in-ingres-stack-overflow/
http://www.ngssoftware.com/advisories...lnerability-in-ingres-stack-overflow/
http://www.ngssoftware.com/advisories...bility-in-ingres-pointer-overwrite-1/
http://www.ngssoftware.com/advisories...bility-in-ingres-pointer-overwrite-2/
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
