|
Ingres Database Multiple Vulnerabilities
|
|
Secunia Advisory:
|
SA25756
|
|
|
Release Date:
|
2007-06-22
|
|
Last Update:
|
2007-06-26
|
|
Popularity:
|
7,325 views
|
|
|
Critical:
|
Moderately critical
|
|
Impact:
|
Manipulation of data
System access
|
|
Where:
|
From local network
|
|
Solution Status:
|
Vendor Patch
|
|
| Software: | Ingres 2.x
Ingres 2006 (9.x)
Ingres 3.x
|
|
|
Secunia CVSS-2 Score:
|
Available in Secunia business solutions 
|
|
|
Subscribe:
|
Instant alerts on relevant vulnerabilities
|
|
| Advisory Content (Page 1 of 3) | [ 1 ] [ 2 ] [ 3 ] | |
|
Description:
Multiple vulnerabilities have been reported in Ingres, which can be exploited by malicious people to truncate a certain file or compromise a vulnerable system.
1) Boundary errors within the Communications Server (iigcc.exe) and Data Access Server (iigcd.exe) can be exploited to cause heap-based buffer overflows by sending overly long, specially-crafted requests to port 10916/TCP (iigcc.exe) or 10923/TCP (iigcd.exe).
2) The problem is that the QUremove and QUinsert functions in the Ingres Communications Server Process (igcc) can be exploited to overwrite an address, which is controlled by the attacker, via sending specially-crafted series of packets to default port 21064/TCP.
3) A boundary error within "uuid_from_char()" can be exploited to cause a stack-based buffer overflow by passing an overly long string as argument.
4) A boundary error in the duve_get_args function within duveutil.c when the Ingres verifydb utility parses command-line arguments can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted argument.
5) The "wakeup" binary, which creates a file named "alarmwkp.def" in the current directory and truncates it if it exists, can be exploited to truncate an arbitrary file with the privileges of the "ingres" user via a symbolic link.
The vulnerabilities affect the following versions:
* Ingres 2006 (version 9.0.4)
* Ingres r3
* Ingres 2.6
* Ingres 2.5
Change Page:
[ 1 ] [ 2 ] [ 3 ]
|
|
|
Track this Secunia Advisory
|
Customers of the Secunia Vulnerability Intelligence solutions will automatically receive updates when new information regarding this advisory is released.
Read more about our Vulnerability Intelligence solutions and what they can do for you and your company.
|
|
|
About this Secunia Advisory
|
Please note: The information that this Secunia Advisory is based on comes from a third party unless stated otherwise.
Secunia collects, validates, and verifies all vulnerability reports issued by security research groups, vendors, and others.
|
