PT-2006-4712 · Ibm · Ibm Informix Dynamic Server

David Litchfield · Publicado 2006-08-17 · Atualizado 2018-10-17 · CVE-2006-3854

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM Informix Dynamic Server (IDS) versions 9.40.TC7 through 9.40.TC8 IBM Informix Dynamic Server (IDS) versions 10.00.TC4 through 10.00.TC5

Description The issue is caused by a buffer overflow when a long username is used, leading to an overflow in the vsprintf function when displaying the resulting error message, allowing remote attackers to execute arbitrary code.

Recommendations For IBM Informix Dynamic Server (IDS) versions 9.40.TC7 through 9.40.TC8, consider restricting access to the login functionality until a patch is available. For IBM Informix Dynamic Server (IDS) versions 10.00.TC4 through 10.00.TC5, consider restricting access to the login functionality until a patch is available. As a temporary workaround, consider limiting the length of the username to prevent the buffer overflow.

Exploit

Correção

Identificadores relacionados

CVE-2006-3854

Produtos afetados

Ibm Informix Dynamic Server

Referências · 6

• 🔥 http://databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf · Exploit
• http://securityreason.com/securityalert/1409 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/28381 · Nota
• http://securityfocus.com/archive/1/443133/100/0/threaded · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2006-3854 · Nota de Segurança
• http://securityfocus.com/archive/1/443150/100/0/threaded · Nota