Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
4.6

Ingres tools let local users elevate privileges

CVE-2008-3389 · published 18 years ago
Summary

On Linux and HP-UX systems, the Ingres database utilities verifydb, iimerge, and csreport have a flaw in the libbecompat component that can be triggered by a specially crafted environment variable. A local user who can run these utilities could increase their access rights on the server. Apply the vendor's security update or restrict execution of these utilities to trusted users until a patch is installed.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
ingres ingres 2.6
2006
cpe:2.3:a:ingres:ingres:2.6:*:*:*:*:*:*:*
Original advisory text
Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileg...
Stack-based buffer overflow in the libbecompat library in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges by setting a long value of an environment variable before running (1) verifydb, (2) iimerge, or (3) csreport.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker partial control (estimated)
Severity
4.6 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-119Buffer Overflow
Timeline
Published5 Aug 2008
Updated4 Nov 2026
First seen29 Sep 2026
Sources
CVE-2008-3389 · NVD
Track software like this
Free during beta