PT-2007-4615 · Actian · Ingres Database Server

Published 2007-06-22 · Updated 2018-10-16 · CVE-2007-3338

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Ingres database server versions 2.5 through 2006 9.0.4, r3, 2.6

Description The issue concerns multiple stack-based buffer overflows that allow remote attackers to execute arbitrary code. This is achieved through the uuid from char or duve get args functions.

Recommendations For Ingres database server versions 2.5 through 2006 9.0.4, r3, 2.6, consider disabling the uuid from char and duve get args functions as a temporary workaround until a patch is available. Restrict access to these functions to minimize the risk of exploitation.

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-3338

Affected Products

Ingres Database Server

References · 15

• http://vupen.com/english/advisories/2007/2288 · Vendor Advisory
• http://secunia.com/advisories/25775 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-3338 · Security Note
• http://vupen.com/english/advisories/2007/2290 · Vendor Advisory
• http://supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp · Patch
• http://secunia.com/advisories/25756 · Vendor Advisory
• http://ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=145778 · Note
• http://ngssoftware.com/advisories/medium-risk-vulnerability-in-ingres-stack-overflow · Note
• http://securityfocus.com/archive/1/472194/100/0/threaded · Note
• http://securityfocus.com/bid/24585 · Note
• http://osvdb.org/37483 · Note
• http://ngssoftware.com/advisories/high-risk-vulnerability-in-ingres-stack-overflow · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34995 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34998 · Note
• http://securityfocus.com/archive/1/472197/100/0/threaded · Note