Description
Ingres 2.5 and 2.6 on Windows, as used in multiple CA products and possibly other products, assigns the privileges and identity of users to be the same as the first user, which allows remote attackers to gain privileges.
References
- ADV-2007-4303 vdb-entry
- 1019134 vdb-entry
- 39358 vdb-entry
- http://www.ingres.com/support/security-alertDec17.php
- 28187 third-party-advisory
- 26959 vdb-entry
- 28183 third-party-advisory
- http://supportconnectw.ca.com/public/ingres/infodocs/ingresmswin-secnot.asp
- ADV-2007-4304 vdb-entry
- 20071221 [CAID 35970]: CA Products That Embed Ingres Authentication Vulnerability mailing-list