CVE-2008-3356
First published: Tue Aug 05 2008(Updated: )
verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Actian Ingres | =2006-release_2 | |
| Actian Ingres | =2006-release_1 | |
| Actian Ingres | =2006-9.0.1 | |
| Actian Ingres | =2.6 | |
| Actian Ingres | =2006-9.0.4 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731
- http://www.ingres.com/support/security-alert-080108.php
- http://www.securityfocus.com/bid/30512
- http://securitytracker.com/id?1020613
- http://secunia.com/advisories/31357
- http://secunia.com/advisories/31398
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989
- http://www.vupen.com/english/advisories/2008/2313
- http://www.vupen.com/english/advisories/2008/2292
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44177
- http://www.securityfocus.com/archive/1/495177/100/0/threaded
Frequently Asked Questions
What is the severity of CVE-2008-3356?
CVE-2008-3356 is considered a medium severity vulnerability due to potential local file overwrite risks.
How do I fix CVE-2008-3356?
To fix CVE-2008-3356, ensure that the ownership and permissions of the iivdb.log file are correctly set and validated before any operations.
Which versions of Ingres are affected by CVE-2008-3356?
CVE-2008-3356 affects Ingres versions 2.6, 2006 release 1 (9.0.4), and 2006 release 2 (9.1.0).
Can local users exploit CVE-2008-3356?
Yes, local users can exploit CVE-2008-3356 to overwrite arbitrary files due to improper validation of log file ownership.
What mitigation strategies can be implemented for CVE-2008-3356?
Mitigation for CVE-2008-3356 includes applying patches provided by the vendor and enforcing strict access controls for log files.
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/severity
- agent/weakness
- agent/references
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/ingres
- canonical/actian ingres
- version/actian ingres/2006-release_2
- version/actian ingres/2006-release_1
- version/actian ingres/2006-9.0.1
- version/actian ingres/2.6
- version/actian ingres/2006-9.0.4