CVE-2008-3357

Untrusted search path vulnerability in ingvalidpw in Ingres 2.6, Ingres 2006 release 1 (aka 9.0.4), and Ingres 2006 release 2 (aka 9.1.0) on Linux and HP-UX allows local users to gain privileges via a crafted shared library, related to a "pointer overwrite vulnerability."

Published: 2008-08-05 Last update: 2026-04-23 Assigner: [email protected] Source: [email protected]

NVD Status：Modified，CVE State: published

View at NVD, CVE.org, EUVD

Conclusion & alert: CVE-2008-3357 is rated Moderate Risk (42.7/100): CVSS High severity, with low exploitation likelihood (EPSS 0.09%). Mandatory action: Review affected assets and schedule remediation.

Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.

Exploit prediction scoring system (EPSS) score for CVE-2008-3357

EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).

#	Date	Old EPSS score	New EPSS score	Delta (New - Old)
1	2024-12-17	0.04%	0.09%	+0.05%
2	2023-03-07	1.28%	0.04%	-1.24%
3	2022-02-04	—	1.28%	—

Full EPSS history (3 records total)

Common vulnerability scoring system (CVSS) metrics for CVE-2008-3357

CVSS metrics for this CVE.

Base score	Version	Severity	Vector	Exploitability	Impact	Score source
7.2	2.0	HIGH	`AV:L/AC:L/Au:N/C:C/I:C/A:C` Click to expand Access vector (AV:L) Requires local access to the target system. Access complexity (AC:L) Exploitation conditions are straightforward and predictable. Authentication (AU:N) No authentication is required. Confidentiality impact (C:C) Complete confidentiality impact. Integrity impact (I:C) Complete integrity impact. Availability impact (A:C) Complete availability impact.	3.9	10.0	[email protected]

Weakness enumeration for CVE-2008-3357

CWE-426 MITRE ↗

NVD evaluator notes for CVE-2008-3357

Solution: Fixes are available for the current release of Ingres 2006 release 2 (9.1.0), for Ingres 2006 release 1 (9.0.4), and for Ingres 2.6 versions on their respective platforms. The security fixes are available and can be quickly applied with little to no anticipated impact to systems. Ingres customers with a current support contract can review the following knowledge base document for information on downloading the available fixes: http://servicedesk.ingres.com/CAisd/pdmweb.ingres?OP=SHOW_DETAIL+PERSID=KD:416012+HTMPL=kt_document_view.htmpl (ingres.com)

Affected software / configurations for CVE-2008-3357

Vendor	Product	Version	Raw CPE
actian	ingres	2.6	cpe:2.3:a:actian:ingres:2.6:::::::*
actian	ingres	9.0.4	cpe:2.3:a:actian:ingres:9.0.4:::::::*
actian	ingres	9.1.0	cpe:2.3:a:actian:ingres:9.1.0:::::::*

References for CVE-2008-3357

URL	Tags
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=733	Broken Link
http://secunia.com/advisories/31357	Third Party Advisory
http://secunia.com/advisories/31398	Third Party Advisory
http://securitytracker.com/id?1020614	Third Party Advisory VDB Entry
http://www.ingres.com/support/security-alert-080108.php	Vendor Advisory
http://www.securityfocus.com/archive/1/495177/100/0/threaded	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/30512	Third Party Advisory VDB Entry
http://www.vupen.com/english/advisories/2008/2292	Third Party Advisory
http://www.vupen.com/english/advisories/2008/2313	Third Party Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/44181	Third Party Advisory VDB Entry
https://support.ca.com/irj/portal/anonymous/phpsupcontent?contentID=181989	Broken Link

cvelogic Threat Intelligence