PT-2019-9296 · Ibm · Ibm Informix Dynamic Server Enterprise Edition

Published 2019-08-20 · Updated 2023-02-24 · CVE-2018-1632

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Informix Dynamic Server Enterprise Edition version 12.1

Description A symbolic link vulnerability in .infxdirs could allow a local user logged in with database administrator privileges to gain root privileges.

Recommendations For IBM Informix Dynamic Server Enterprise Edition version 12.1, consider restricting access to the .infxdirs directory to prevent exploitation of the symbolic link vulnerability until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2018-1632

Affected Products

Ibm Informix Dynamic Server Enterprise Edition

References · 5

• http://ibm.com/support/docview.wss?uid=ibm10964987 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-1632 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1632 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/144432 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190903-0002 · Note