PT-2007-4613 · Actian · Ingres Database Server

Publicado 2007-06-22 · Atualizado 2018-10-16 · CVE-2007-3336

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ingres database server versions 2.5 through 2006 9.0.4

Description The issue allows remote attackers to execute arbitrary code by sending certain TCP data at different times to the Ingres Communications Server Process (iigcc), which calls the (1) QUinsert or (2) QUremove functions with attacker-controlled input.

Recommendations For Ingres database server versions 2.5 through 2006 9.0.4, consider restricting access to the iigcc process until a patch is available. As a temporary workaround, consider disabling the QUinsert and QUremove functions until a fix is provided. Avoid sending certain TCP data to the Ingres Communications Server Process to minimize the risk of exploitation.

Exploit

Correção

Identificadores relacionados

CVE-2007-3336

Produtos afetados

Ingres Database Server

Referências · 16

• 🔥 https://exploit-db.com/exploits/14646 · Exploit
• http://ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=145778 · Nota
• http://vupen.com/english/advisories/2007/2288 · Aviso do Fabricante
• http://secunia.com/advisories/25775 · Aviso do Fabricante
• http://ngssoftware.com/advisories/critical-risk-vulnerability-in-ingres-pointer-overwrite-1 · Nota
• http://securityfocus.com/archive/1/472193/100/0/threaded · Nota
• http://ngssoftware.com/advisories/critical-risk-vulnerability-in-ingres-pointer-overwrite-2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/35000 · Nota
• http://vupen.com/english/advisories/2007/2290 · Aviso do Fabricante
• http://securityfocus.com/bid/24585 · Nota
• http://supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp · Correção
• http://osvdb.org/37486 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-3336 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34993 · Nota
• http://secunia.com/advisories/25756 · Aviso do Fabricante