IBM Informix Dynamic Server Integer Overflow Vulnerability

Bugtraq ID:	44187
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 18 2010 12:00AM
Updated:	Oct 18 2010 12:00AM
Credit:	Sebastian Apelt
Vulnerable:	IBM Informix IDS 9.40 .UC3 IBM Informix IDS 9.40 .UC2 IBM Informix IDS 9.40 .UC1 IBM Informix IDS 9.40.xC10 IBM Informix IDS 9.40.UC5 IBM Informix IDS 9.40.TC5 IBM Informix IDS 9.40 IBM Informix IDS 9.4 IBM Informix IDS 7.31.xD11 IBM Informix IDS 7.31 .xD9 IBM Informix IDS 7.31 .xD8 IBM Informix IDS 7.3 IBM Informix IDS 11.10.xC2 IBM Informix IDS 11.10.TC3 IBM Informix IDS 11.10 IBM Informix IDS 10.00.xC8 IBM Informix IDS 10.00.xC7W1 IBM Informix IDS 10.00.xC11 IBM Informix IDS 10.00.xC10 IBM Informix IDS 10.00.TC9 IBM Informix IDS 10.0.xC4 IBM Informix IDS 10.0 xC3 IBM Informix IDS 10.0
Not Vulnerable:	IBM Tivoli Netcool ISM 2.3

IBM Informix Dynamic Server Integer Overflow Vulnerability

IBM Informix is prone to an integer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue may allow an attacker to execute arbitrary code with SYSTEM-level privileges, completely compromising affected computers. Failed exploit attempts will result in a denial-of-service condition.

IBM Informix Dynamic Server Integer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Informix Dynamic Server Integer Overflow Vulnerability

Solution:
Vendor updates are available. Please see the referenced advisories for more information.

IBM Informix Dynamic Server Integer Overflow Vulnerability

References:

• IBM Homepage (IBM)
  
• IBM Informix Dynamic Server librpc.dll Integer Overflow Remote Code Execution Vu (Zero Day Initiative)