CVEvulnerability
CVE-2008-3356
4.6 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2008-08-05
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 4.6 MEDIUM — AV:L/AC:L/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-264
Description
verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.
Affected configurations
• ingres ingres 2.6
• ingres ingres 2006
Related
Weakness · not in database (1)
References
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731 labs.idefense.com
- http://secunia.com/advisories/31357 Vendor Advisory
- http://secunia.com/advisories/31398 secunia.com
- http://securitytracker.com/id?1020613 securitytracker.com
- http://www.ingres.com/support/security-alert-080108.php www.ingres.com
- http://www.securityfocus.com/archive/1/495177/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/30512 www.securityfocus.com
- http://www.vupen.com/english/advisories/2008/2292 www.vupen.com
- http://www.vupen.com/english/advisories/2008/2313 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44177 exchange.xforce.ibmcloud.com
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989 support.ca.com
- http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=731 labs.idefense.com
- http://secunia.com/advisories/31357 Vendor Advisory
- http://secunia.com/advisories/31398 secunia.com
- http://securitytracker.com/id?1020613 securitytracker.com
- http://www.ingres.com/support/security-alert-080108.php www.ingres.com
- http://www.securityfocus.com/archive/1/495177/100/0/threaded www.securityfocus.com
- http://www.securityfocus.com/bid/30512 www.securityfocus.com
- http://www.vupen.com/english/advisories/2008/2292 www.vupen.com
- http://www.vupen.com/english/advisories/2008/2313 www.vupen.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/44177 exchange.xforce.ibmcloud.com
- https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989 support.ca.com