PT-2010-5274 · Ibm · Ibm Informix Dynamic Server

Sebastian Apelt · Published 2010-10-25 · Updated 2010-10-27 · CVE-2010-4070

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Informix Dynamic Server (IDS) versions 7.x through 7.31.xD10 IBM Informix Dynamic Server (IDS) versions 9.x through 9.40.xC9 IBM Informix Dynamic Server (IDS) versions 10.00 through 10.00.xC7 IBM Informix Dynamic Server (IDS) versions 11.10 through 11.10.xC1

Description The issue is caused by an integer overflow in librpc.dll in portmap.exe, allowing remote attackers to execute arbitrary code or cause a denial of service via a crafted parameter size. This can result in heap memory corruption.

Recommendations For IBM Informix Dynamic Server (IDS) versions 7.x through 7.31.xD10, update to version 7.31.xD11 or later. For IBM Informix Dynamic Server (IDS) versions 9.x through 9.40.xC9, update to version 9.40.xC10 or later. For IBM Informix Dynamic Server (IDS) versions 10.00 through 10.00.xC7, update to version 10.00.xC8 or later. For IBM Informix Dynamic Server (IDS) versions 11.10 through 11.10.xC1, update to version 11.10.xC2 or later.

Fix

Weakness Enumeration

CWE-189

Related Identifiers

CVE-2010-4070

Affected Products

Ibm Informix Dynamic Server

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2010-4070 · Security Note
• http://vupen.com/english/advisories/2010/2733 · Vendor Advisory
• http://secunia.com/advisories/41915 · Vendor Advisory
• http://osvdb.org/68706 · Note
• http://zerodayinitiative.com/advisories/ZDI-10-215 · Note