Unscored severity · published Aug 5, 2008
CVE-2008-3356
verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an…
–
CVSS
0.4%
EPSS
No
On KEV
Description
verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.
Exploitation
Is it being used?
Exploit prediction (EPSS)0.4% · higher than 31% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Ingres · Ingres
2.6; 2006; 2006; 2006; 2006 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2008-3356
CVE.org
https://www.cve.org/CVERecord?id=CVE-2008-3356
labs.idefense.com
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731
Vendor Advisory
http://secunia.com/advisories/31357
secunia.com
http://secunia.com/advisories/31398
securitytracker.com
http://securitytracker.com/id?1020613
www.ingres.com
http://www.ingres.com/support/security-alert-080108.php
www.securityfocus.com
http://www.securityfocus.com/archive/1/495177/100/0/threaded
More from Ingres
–
CVE-2008-3389
Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local…
–
CVE-2007-6334
Ingres 2.5 and 2.6 on Windows, as used in multiple CA products and possibly other products, assigns the privileges and identity of users to be the same as the first user, which…