Ingres Database Detection

This host is running Ingres Database. Ingres Database is an open source database management system. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier:...

Ingres Database uuid_from_char Stack Buffer Overflow (CVE-2007-3338)

Ingres Database is a relational DataBase Management System DBMS product developed by Ingres. Ingres Database is made available for both Windows and Unix-like platforms. The product is embedded by other software vendors, such as Computer Associates CA in its eTrust and Unicenter products. A stack...

Ingres database server multiple security vulnerabilities

Weak file permissions, insecure shared library loading, buffer overflow in different utilities...

CA Products That Embed Ingres Multiple Vulnerabilities

Title: CA Products That Embed Ingres Multiple Vulnerabilities CA Advisory Date: 2008-08-01 Reported By: iDefense Labs Impact: A remote attacker can execute arbitrary code, gain privileges, or cause a denial of service condition. Summary: CA products that embed Ingres contain multiple...

CA Products That Embed Ingres Multiple Vulnerabilities

Title: CA Products That Embed Ingres Multiple Vulnerabilities CA Advisory Date: 2008-08-01 Reported By: iDefense Labs Impact: A remote attacker can execute arbitrary code, gain privileges, or cause a denial of service condition. Summary: CA products that embed Ingres contain multiple...

Ingres Database Multiple Local Vulnerabilities

Binary data 4615.prm...

Stack overflow

Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 aka 9.0.4, and Ingres 2006 release 2 aka 9.1.0 on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running 1 verifydb, 2 iimerge, or 3 csrepor...

CVE-2008-3389

Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 aka 9.0.4, and Ingres 2006 release 2 aka 9.1.0 on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running 1 verifydb, 2 iimerge, or 3 csrepor...

Design/Logic Flaw

Untrusted search path vulnerability in ingvalidpw in Ingres 2.6, Ingres 2006 release 1 aka 9.0.4, and Ingres 2006 release 2 aka 9.1.0 on Linux and HP-UX allows local users to gain privileges via a crafted shared library, related to a "pointer overwrite vulnerability."...

CVE-2008-3357

Untrusted search path vulnerability in ingvalidpw in Ingres 2.6, Ingres 2006 release 1 aka 9.0.4, and Ingres 2006 release 2 aka 9.1.0 on Linux and HP-UX allows local users to gain privileges via a crafted shared library, related to a "pointer overwrite vulnerability."...

Code injection

verifydb in Ingres 2.6, Ingres 2006 release 1 aka 9.0.4, and Ingres 2006 release 2 aka 9.1.0 on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files ...

CVE-2008-3356

verifydb in Ingres 2.6, Ingres 2006 release 1 aka 9.0.4, and Ingres 2006 release 2 aka 9.1.0 on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files ...

CVE-2008-3356

CVE-2008-3356 affects Ingres products (notably verifydb in Ingres 2.6 and Ingres 2006 Release 1/2) on Linux/Unix. The issue arises when verifydb sets ownership/permissions of iivdb.log without confirming it is the application log, allowing a local attacker to overwrite arbitrary files by creating...

CVE-2008-3357

Untrusted search path vulnerability in ingvalidpw in Ingres 2.6, Ingres 2006 release 1 aka 9.0.4, and Ingres 2006 release 2 aka 9.1.0 on Linux and HP-UX allows local users to gain privileges via a crafted shared library, related to a "pointer overwrite vulnerability."...

CVE-2008-3389

CVE-2008-3389 describes a stack-based buffer overflow in Ingres libbecompat that can let a local user gain privileges by supplying a long environment variable value before running verifydb, iimerge, or csreport on Linux and HP-UX. Affected runtimes include Ingres 2.6, Ingres 2006 release 1 (9.0.4...

CVE-2008-3357

CVE-2008-3357 : Untrusted search path vulnerability in ingvalidpw of Ingres 2.6, Ingres 2006 Release 1 (9.0.4), and Ingres 2006 Release 2 (9.1.0) on Linux/HP-UX allows local users to gain privileges by loading a crafted shared library. Exploitation is local and tied to the ingvalidpw helper (set-...

CVE-2008-3356

verifydb in Ingres 2.6, Ingres 2006 release 1 aka 9.0.4, and Ingres 2006 release 2 aka 9.1.0 on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files ...

CVE-2008-3389

Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 aka 9.0.4, and Ingres 2006 release 2 aka 9.1.0 on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running 1 verifydb, 2 iimerge, or 3 csrepor...

Ingres数据库多个本地安全漏洞

BUGTRAQ ID: 30512 CVECAN ID: CVE-2008-3357,CVE-2008-3389,CVE-2008-3356 Ingres是很多CA产品默认所使用的数据库后端。 Ingres数据库中所捆绑的ingvalidpw工具用于验证用户凭据。在加载共享库时，ingvalidpw程序会加载ingres用户目录中的库，因此拥有ingres权限的用户可以通过特制的库获得root权限。 Ingres数据库所捆绑的一些ingres工具会使用libbecompat库。在将环境变量拷贝到固定大小的栈缓冲区时，该库没有对源字符串执行长度检查，导致栈溢出漏洞。...

iDefense Security Advisory 08.01.08: Ingres Database for Linux ingvalidpw Untrusted Library Path Vulnerability

iDefense Security Advisory 08.01.08 http://labs.idefense.com/intelligence/vulnerabilities/ Aug 01, 2008 I. BACKGROUND Ingres Database is a database server used in several Computer Associates' products. For example, CA Directory Service use thes Ingres Database server. More information can be foun...