News
Vigil@nce: Ingres Database, buffer overflow via IIPROMPT
September 2011 by Vigil@nce
This bulletin was written by Vigil@nce : http://vigilance.fr/offer
SYNTHESIS OF THE VULNERABILITY
When Ingres Database is installed on Windows, an attacker can
generate an overflow, in order to execute code.
– Severity: 2/4
– Creation date: 05/09/2011
IMPACTED PRODUCTS
– Ingres Database
DESCRIPTION OF THE VULNERABILITY
The Windows iigcn.exe (GCN - General Communications Name Server)
service is used to route queries to the associated server.
The IIPROMPT1, IIPROMPTONCE and IIPROMPTALL queries processes the
access to the GCN service.
An attacker can use a malicious IIPROMPT* query, in order to
create an overflow in iigcn.exe. Technical details are unknown.
When Ingres Database is installed on Windows, an attacker can
therefore generate an overflow, in order to execute code.
ACCESS TO THE COMPLETE VIGIL@NCE BULLETIN
http://vigilance.fr/vulnerability/Ingres-Database-buffer-overflow-via-IIPROMPT-10968
