CVE-2008-3389: Buffer Overflow
Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running (1) verifydb, (2) iimerge, or (3) csreport.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2008-3389?
CVE-2008-3389 has a high severity level due to its potential for privilege escalation through a buffer overflow.
How do I fix CVE-2008-3389?
To fix CVE-2008-3389, it is recommended to update Ingres to the latest version where the vulnerability has been patched.
Who is affected by CVE-2008-3389?
CVE-2008-3389 affects users of Ingres versions 2.6, 2006 release 1, and 2006 release 2 running on Linux and HP-UX.
What causes the vulnerability in CVE-2008-3389?
The vulnerability in CVE-2008-3389 is caused by a stack-based buffer overflow in the libbecompat library related to environment variable handling.
Can CVE-2008-3389 be exploited remotely?
CVE-2008-3389 cannot be exploited remotely as it requires local user access to trigger the buffer overflow.