Unscored severity · published Jun 22, 2007
CVE-2007-3338
Multiple stack-based buffer overflows in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allow remote attackers to…
–
CVSS
6.7%
EPSS
No
On KEV
Description
Multiple stack-based buffer overflows in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allow remote attackers to execute arbitrary code via the (1) uuid_from_char or (2) duve_get_args functions.
Exploitation
Is it being used?
Exploit prediction (EPSS)6.7% · higher than 94% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
DS
Database Server · Ingres
2.5; 2.6; 9.0.4; r3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2007-3338
CVE.org
https://www.cve.org/CVERecord?id=CVE-2007-3338
osvdb.org
http://osvdb.org/37483
Vendor Advisory
http://secunia.com/advisories/25756
Vendor Advisory
http://secunia.com/advisories/25775
Patch
http://supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.asp
www.ca.com
http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=145778
www.ngssoftware.com
http://www.ngssoftware.com/advisories/high-risk-vulnerability-in-ingres-stack-overflow/
More from Database Server
–
CVE-2007-3336
Multiple "pointer overwrite" vulnerabilities in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (formerly Computer Associates) products, allow remote…
–
CVE-2007-3337
wakeup in Ingres database server 2006 9.0.4, r3, 2.6, and 2.5, as used in multiple CA (Computer Associates) products, allows local users to truncate arbitrary files via a symlink…
–
CVE-2007-3334
Multiple heap-based buffer overflows in the (1) Communications Server (iigcc.exe) and (2) Data Access Server (iigcd.exe) components for Ingres Database Server 3.0.3, as used in CA…