Secunia

Multiple vulnerabilities have been reported in Ingres, which can be exploited by malicious people to truncate a certain file or compromise a vulnerable system.

1) Boundary errors within the Communications Server (iigcc.exe) and Data Access Server (iigcd.exe) can be exploited to cause heap-based buffer overflows by sending overly long, specially-crafted requests to port 10916/TCP (iigcc.exe) or 10923/TCP (iigcd.exe).

2) The problem is that the QUremove and QUinsert functions in the Ingres Communications Server Process (igcc) can be exploited to overwrite an address, which is controlled by the attacker, via sending specially-crafted series of packets to default port 21064/TCP.

3) A boundary error within "uuid_from_char()" can be exploited to cause a stack-based buffer overflow by passing an overly long string as argument.

4) A boundary error in the duve_get_args function within duveutil.c when the Ingres verifydb utility parses command-line arguments can be exploited to cause a stack-based buffer overflow via an overly long, specially-crafted argument.

5) The "wakeup" binary, which creates a file named "alarmwkp.def" in the current directory and truncates it if it exists, can be exploited to truncate an arbitrary file with the privileges of the "ingres" user via a symbolic link.

The vulnerabilities affect the following versions:
* Ingres 2006 (version 9.0.4)
* Ingres r3
* Ingres 2.6
* Ingres 2.5

Solution
Apply patches. Please see the vendor's advisory for details.

Provided and/or discovered by
1) Discovered by an anonymous person and reported via iDefense Labs.
2-5) Chris Anley, NGSSoftware, Ltd.

Changelog
Further details available in Customer Area

Original Advisory
CA/Ingres:
http://supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp

iDefense Labs:
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=546

Ingres (requires login):
http://servicedesk.ingres.com/CAisd/pdmweb.ingres?OP=SHOW_DETAIL+PERSID=KD:415738+HTMPL=kt_document_view.htmpl

NGSSoftware:
http://www.ngssoftware.com/advisories/medium-risk-vulnerability-in-ingres-file-truncation/
http://www.ngssoftware.com/advisories/medium-risk-vulnerability-in-ingres-stack-overflow/
http://www.ngssoftware.com/advisories/high-risk-vulnerability-in-ingres-stack-overflow/
http://www.ngssoftware.com/advisories/critical-risk-vulnerability-in-ingres-pointer-overwrite-1/
http://www.ngssoftware.com/advisories/critical-risk-vulnerability-in-ingres-pointer-overwrite-2/

Deep Links
Links available in Customer Area