PT-2019-9298 · Ibm · Ibm Informix Dynamic Server Enterprise Edition

Published 2019-08-20 · Updated 2023-02-24 · CVE-2018-1634

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM Informix Dynamic Server Enterprise Edition version 12.1

Description A symbolic link vulnerability exists in infos.DBSERVERNAME, which could allow a local user logged in with database administrator privileges to gain root privileges.

Recommendations For IBM Informix Dynamic Server Enterprise Edition version 12.1, consider restricting access to the infos.DBSERVERNAME to minimize the risk of exploitation until a patch is available.

Fix

Link Following

Weakness Enumeration

CWE-59

Related Identifiers

CVE-2018-1634

Affected Products

Ibm Informix Dynamic Server Enterprise Edition

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2018-1634 · Security Note
• https://osv.dev/vulnerability/CVE-2018-1634 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=ibm10964987 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/144437 · Vendor Advisory
• https://security.netapp.com/advisory/ntap-20190903-0002 · Note