CVE-2008-3389 Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges....
MediumCVSS 4.6
EPSS 0.44%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running (1) verifydb, (2) iimerge, or (3) csreport.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| ingres | = 2.6 | No fix listed |
| ingres | = 2006-9.0.4 | No fix listed |
| ingres | = 2006-9.1.0 | No fix listed |
References
- 20080801 Ingres Database for Linux libbecompat Stack Based Buffer Overflow Vulnerability broken-link third-party-advisory
- 31357 third-party-advisory
- 31398 third-party-advisory
- 1020615 third-party-advisory vdb-entry
- www.ingres.com broken-link
- 20080806 CA Products That Embed Ingres Multiple Vulnerabilities mailing-list
- 30512 third-party-advisory vdb-entry
- ADV-2008-2292 third-party-advisory vdb-entry
- ADV-2008-2313 third-party-advisory vdb-entry
- ingres-libbecompat-bo(44179) third-party-advisory vdb-entry
- support.ca.com broken-link