PT-2019-9295 · Ibm · Ibm Informix Dynamic Server Enterprise Edition

Published 2019-08-20 · Updated 2023-02-24 · CVE-2018-1631

Positive Technologies (AI Summary)

CVSS v3.1

8.2

High

Base vector

I:H/PR:H/C:H/AC:L/UI:N/S:C/AV:L/A:H

Name of the Vulnerable Software and Affected Versions IBM Informix Dynamic Server Enterprise Edition version 12.1

Description The issue allows a local user logged in with database administrator privileges to gain root privileges through a symbolic link vulnerability in oninit mongohash.

Recommendations For IBM Informix Dynamic Server Enterprise Edition version 12.1, consider restricting access to the oninit mongohash functionality to minimize the risk of exploitation until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2018-1631

Affected Products

Ibm Informix Dynamic Server Enterprise Edition

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1631 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1631 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/144431 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=ibm10964987 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190903-0002 · Note
• https://t.me/cvenotify/44861 · Telegram Post