Ingres用户认证非授权访问漏洞

BUGTRAQ ID: 26959 CVE(CAN) ID: CVE-2007-6334 Ingres是很多CA产品默认所使用的数据库后端。 Windows平台上的Ingres数据库为之后连接的用户分配了与第一个连接用户相同的权限和身份，这允许远程攻击者获得非授权访问。仅在运行于Microsoft IIS Web服务器上且启用了集成Windows认证（IWA）选项的情况下才会出现这个漏洞。 Ingres Corporation Ingres Database 2.6 Ingres Corporation Ingres Database 2.5 厂商补丁： Ingres Corporation ------------------ 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下载： <a href=ftp://ftp.ca.com/caproducts/ips/MDB/Generic_Ingres/IIS_Vulnerability/patch-2.5.0605.12291-win-x86.zip target=_blank>ftp://ftp.ca.com/caproducts/ips/MDB/Generic_Ingres/IIS_Vulnerability/patch-2.5.0605.12291-win-x86.zip</a> <a href=ftp://ftp.ca.com/caproducts/ips/MDB/Generic_Ingres/IIS_Vulnerability/patch-2.6.0701.12467-win-x86.zip target=_blank>ftp://ftp.ca.com/caproducts/ips/MDB/Generic_Ingres/IIS_Vulnerability/patch-2.6.0701.12467-win-x86.zip</a> <a href=ftp://ftp.ca.com/caproducts/ips/MDB/Generic_Ingres/IIS_Vulnerability/patch-2.6.0701.12473-win-x86-DBL.zip target=_blank>ftp://ftp.ca.com/caproducts/ips/MDB/Generic_Ingres/IIS_Vulnerability/patch-2.6.0701.12473-win-x86-DBL.zip</a>