Check Point Advisories

Ingres Database uuid_from_char Stack Buffer Overflow (CVE-2007-3338)

Vulnerability
Protection

Check Point Reference:	CPAI-2007-286
Date Published:	15 Nov 2009
Severity:	High
Last Updated:	Sunday 15 November, 2009
Source:
Industry Reference:	CVE-2007-3338
Protection Provided by:	Security Gateway R81, R80, R77, R75
Who is Vulnerable?
Vulnerability Description	Ingres Database is a relational DataBase Management System (DBMS) product developed by Ingres. Ingres Database is made available for both Windows and Unix-like platforms. The product is embedded by other software vendors, such as Computer Associates (CA) in its eTrust and Unicenter products. A stack buffer overflow vulnerability exists in Ingres Database Server. The vulnerability is due to insufficient boundary check when handling user supplied data. A remote authenticated attacker may leverage this vulnerability by executing a specially crafted SQL statement. Successful exploitation may cause the execution of arbitrary code on the target system with System privileges. If code injection attack is successful, the behaviour of the target is entirely dependent on the intended function of the injected code. The code in such a case would execute within the security of the affected process, commonly the SYSTEM account on Windows platforms. In an attack case where code injection is not successful, the Ingres Database Server process will terminate abnormally, creating a denial-of-service condition.

Protection Overview

This protection will detect and block attempts to exploit this vulnerability over the default port of Ingres Database which is 21064/TCP.

In order for the protection to be activated, update your Security Gateway product to the latest IPS update. For information on how to update IPS, go to SBP-2006-05, click on Protection tab and select the version of your choice.

Security Gateway R80 / R77 / R75

In the IPS tab, click Protections and find the Ingres Database uuid_from_char Stack Buffer Overflow protection using the Search tool and Edit the protection's settings.
Install policy on all Security Gateways.

This protection's log will contain the following information:

Attack Name: Database Protection Violation.
Attack Information: Ingres Database uuid_from_char stack buffer overflow