Title: [CAID 35450, 35451, 35452, 35453]: CA Products That Embed

Ingres Multiple Vulnerabilities

CA Vuln ID (CAID): 35450, 35451, 35452, 35453

CA Advisory Date: 2007-06-21

Reported By: NGSSoftware, and iDefense

Impact: Attackers can potentially execute arbitrary code, or

overwrite files.

Summary: Various CA products that embed Ingres products contain

multiple vulnerabilities that can allow an attacker to potentially

execute arbitrary code. CA has issued fixes, to address all of

these vulnerabilities, for all supported CA products that may be

affected.

1) Ingres controllable pointer overwrite vulnerability (reported

by NGSSoftware) [Ingres bug 115927, CVE-2007-3336, CAID 35450]

Description: An unauthenticated attacker can potentially execute

arbitrary code within the context of the database server.

2) Ingres remote unauthenticated pointer overwrite #2 (reported by

NGSSoftware) [Ingres bug 115927, CVE-2007-3336, CAID 35450]

Description: An unauthenticated attacker can exploit a pointer

overwrite vulnerability to execute arbitrary code within the

context of the database server.

3) Ingres wakeup file overwrite (reported by NGSSoftware)

[Ingres bug 115913, CVE-2007-3337, CAID 35451]

Description: The "wakeup" binary creates a file named

"alarmwkp.def" in the current directory, truncating the file if it

already exists. The "wakeup" binary is setuid "ingres" and

world-executable. Consequently, an attacker can truncate a file

with the privileges of the "ingres" user.

4) Ingres uuid_from_char stack overflow (reported by NGSSoftware)

[Ingres bug 115911, CVE-2007-3338, CAID 35452]

Description: An attacker can pass a long string as an argument to

uuid_from_char() to cause a stack buffer overflow and the saved

returned address can be overwritten.

5) Ingres verifydb local stack overflow (reported by NGSSoftware)

[Ingres bug 115911, CVE-2007-3338, CAID 35452]

Description: A local attacker can exploit a stack overflow in the

Ingres verifydb utility duve_get_args function.

6) Communication server heap corruption (reported by iDefense)

[Ingres bug 117523, CVE-2007-3334, CAID 35453]

Description: An attacker can execute arbitrary code within the

context of the communications server (iigcc.exe). This only

affects Ingres on the Windows operating system. Reported by

iDefense as IDEF2023.

7) Data Access/JDBC server heap corruption (reported by iDefense)

[Ingres bug 117523, CVE-2007-3334, CAID 35453]

Description: An attacker can execute arbitrary code within the

context of the Data Access server (iigcd.exe) in r3 or the JDCB

server in older releases. This only affects Ingres on the Windows

operating system. Reported by iDefense as IDEF2022.

Mitigating Factors: None

Severity: CA has given these vulnerabilities a cumulative High

risk rating.

Affected Products:

Advantage Data Transformer r2.2

AllFusion Enterprise Workbench r1.1, 1.1 SP1, r7, r7.1

AllFusion Harvest Change Manager r7, r7.1

BrightStor ARCserve Backup v9 (Linux only), r11.1, r11.5 (Unix,

Linux and Mainframe Linux)

BrightStor ARCserve Backup for Laptops and Desktops r11.5

BrightStor Enterprise Backup (Unix only) r10.5

BrightStor Storage Command Center r11.5

BrightStor Storage Resource Manager r11.5

CleverPath Aion Business Rules Expert r10.1

CleverPath Aion Business Process Monitoring r10.1

CleverPath Predictive Analysis Server r3

DocServer 1.1

eTrust Admin v8, v8.1, r8.1 SP1, r8.1 SP2

eTrust Audit r8 SP2

eTrust Directory r8.1

eTrust IAM Suite r8.0

eTrust IAM Toolkit r8.0, r8.1

eTrust Identity Manager r8.1

eTrust Network Forensics r8.1

eTrust Secure Content Manager r8

eTrust Single Sign-On r7, r8, r8.1

eTrust Web Access Control 1.0

Unicenter Advanced Systems Management r11

Unicenter Asset Intelligence r11

Unicenter Asset Management r11

Unicenter Asset Portfolio Management r11.2.1, r11.3

Unicenter CCS r11

Unicenter Database Command Center r11.1

Unicenter Desktop and Server Management r11

Unicenter Desktop Management Suite r11

Unicenter Enterprise Job Manager r1 SP3, r1 SP4

Unicenter Job Management Option r11

Unicenter Lightweight Portal 2

Unicenter Management Portal r3.1.1

Unicenter Network and Systems Management r3.0, r11

Unicenter Network and Systems Management - Tiered - Multi Platform

r3.0 0305, r3.1 0403, r11.0

Unicenter Patch Management r11

Unicenter Remote Control 6, r11

Unicenter Service Accounting r11, r11.1

Unicenter Service Assure r2.2, r11, r11.1

Unicenter Service Catalog r11, r11.1

Unicenter Service Delivery r11.0, r11.1

Unicenter Service Intelligence r11

Unicenter Service Metric Analysis r3.0.2, r3.5, r11, r11.1

Unicenter ServicePlus Service Desk 5.5 SP3, 6.0, 6.0 SP1, r11,

r11.1, r11.2

Unicenter Software Delivery r11

Unicenter TNG 2.4, 2.4.2, 2.4.2J

Unicenter Workload Control Center r1 SP3, r1 SP4

Unicenter Web Services Distributed Management 3.11, 3.50

Wily SOA Manager 7.1

Affected Platforms:

All operating system platforms supported by the various CA

products that embed Ingres. This includes Windows, Linux, and

supported UNIX platforms.

Status and Recommendation:

CA recommends that customers apply the appropriate fix(es) listed

on the Security Notice page:

http://supportconnectw.ca.com/premium/ca_common_docs/ingres/ingres_secno
tice.asp

Workaround: None

References (URLs may wrap):

CA SupportConnect:

http://supportconnect.ca.com/

CA SupportConnect Security Notice for these vulnerabilities:

Ingres Security Alert

http://supportconnectw.ca.com/public/ca_common_docs/ingresvuln_letter.as
p

Important Security Notice for Customers Using Products That Embed

Ingres

http://supportconnectw.ca.com/premium/ca_common_docs/ingres/ingres_secno
tice.asp

CA Security Advisor posting:

CA Products That Embed Ingres Multiple Vulnerabilities

http://www.ca.com/us/securityadvisor/newsinfo/collateral.aspx?cid=145778

CA Vuln ID (CAID): 35450, 35451, 35452, 35453

http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35450

http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35451

http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35452

http://www.ca.com/us/securityadvisor/vulninfo/vuln.aspx?id=35453

Ingres knowledge base document:

http://servicedesk.ingres.com/CAisd/pdmweb.ingres?OP=SHOW_DETAIL+PERSID=
KD:415738+HTMPL=kt_document_view.htmpl

Reported By: NGSSoftware, and iDefense

NGSSoftware Advisory:

http://www.ngssoftware.com/research/advisories/

iDefense Advisory:

Ingres Database Multiple Heap Corruption Vulnerabilities

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=546

CVE References:

CVE-2007-3336, CVE-2007-3337, CVE-2007-3338, CVE-2007-3334

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3336

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3337

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3338

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-3334

OSVDB References: Pending

http://osvdb.org/

Changelog for this advisory:

v1.0 - Initial Release

Customers who require additional information should contact CA

Technical Support at http://supportconnect.ca.com.

For technical questions or comments related to this advisory,

please send email to vuln AT ca DOT com.

If you discover a vulnerability in CA products, please report your

findings to vuln AT ca DOT com, or utilize our "Submit a

Vulnerability" form.

URL: http://www.ca.com/us/securityadvisor/vulninfo/submit.aspx

Regards,

Ken Williams ; 0xE2941985

Director, CA Vulnerability Research

CA, 1 CA Plaza, Islandia, NY 11749

Contact http://www.ca.com/us/contact/

Legal Notice http://www.ca.com/us/legal/

Privacy Policy http://www.ca.com/us/privacy/

Copyright (c) 2007 CA. All rights reserved.

[ reply ]