Technical Description

Multiple vulnerabilities have been identified in IBM Informix Dynamic Server, which could be exploited by attackers or malicious users to execute arbitrary commands, bypass security restrictions, disclose sensitive information, or cause a denial of service.

The first issue is due to buffer overflow errors in the "DBINFO()", "LOTOFILE()", "FILETOCLOB()", "getname()", and "ifx_file_to_file()" functions, which could be exploited by attackers to execute arbitrary commands or crash a vulnerable application.

The second vulnerability is due to buffer overflow errors when processing a malformed "SET DEBUG FILE" statement or a specially crafted "SQLIDEBUG" environment variable, which could be exploited by attackers to execute arbitrary commands or crash a vulnerable application.

The third flaw is due to a buffer overflow error when handling an overly long username, which could be exploited by attackers to compromise a vulnerable system.

The fourth issue is due to input validation errors when processing specially crafted "dbimp" and "dbexp" procedures in sysmaster, which could be exploited by attackers to execute arbitrary commands.

The fifth vulnerability is due to an input validation error when processing a specially crafted "SET DEBUG FILE" statement, which could be exploited by attackers to execute arbitrary commands.

Other security issues could be exploited by malicious users to create an arbitrary database, obtain elevated privileges (via C code UDR), cause a denial of service, or gain knowledge of sensitive information (e.g. passwords are stored in plain text in shared memory).

Affected Products

IBM Informix Dynamic Server version 7.3
IBM Informix Dynamic Server version 9.4
IBM Informix Dynamic Server version 10.0

Solution

Upgrade to version IBM Informix Dynamic Server version 7.31.xD9, 9.40.xC8, or 10.00.xC4 :
http://www-1.ibm.com/support/docview.wss?rs=0&uid=swg24009130

References

http://www.vupen.com/english/advisories/2006/3077
http://www-1.ibm.com/support/docview.wss?uid=swg21242921

Credits

Vulnerabilities reported by David Litchfield and Next Generation Security Software

ChangeLog

2006-08-01 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.