exploitDog

CVE-2008-3356

Опубликовано: 05 авг. 2008

Источник: nvd

CVSS2: 4.6

EPSS Низкий

Описание

verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.

Комментарий

This vulnerability affects all platforms except VMS and Windows

Ссылки

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:ingres:ingres:2.6:*:*:*:*:*:*:*

cpe:2.3:a:ingres:ingres:2006:9.0.1:*:*:*:*:*:*

cpe:2.3:a:ingres:ingres:2006:9.0.4:*:*:*:*:*:*

cpe:2.3:a:ingres:ingres:2006:release_1:*:*:*:*:*:*

cpe:2.3:a:ingres:ingres:2006:release_2:*:*:*:*:*:*

EPSS

Процентиль: 14%

0.00045

Низкий

4.6 Medium

CVSS2

Дефекты

CWE-264

Связанные уязвимости

GHSA-cgvm-rcgv-pjm9

github

почти 4 года назад

verifydb in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and other Unix platforms sets the ownership or permissions of an iivdb.log file without verifying that it is the application's own log file, which allows local users to overwrite arbitrary files by creating a symlink with an iivdb.log filename.

EPSS

Процентиль: 14%

0.00045

Низкий

4.6 Medium

CVSS2

Дефекты

CWE-264