IBM Informix Dynamic Server DBINFO keyword Remote Stack Buffer Overflow Vulnerability

Bugtraq ID:	44190
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 18 2010 12:00AM
Updated:	Oct 18 2010 12:00AM
Credit:	Anonymous
Vulnerable:	IBM Informix IDS 11.50.xC5 IBM Informix IDS 11.50.xC3 IBM Informix IDS 11.50.xC1 IBM Informix IDS 11.50 IBM Informix IDS 11.10.xC4 IBM Informix IDS 11.10.xC3 IBM Informix IDS 11.10.xC2W2 IBM Informix IDS 11.10.xC2 IBM Informix IDS 11.10.TC3 IBM Informix IDS 11.10 IBM Informix IDS 10.00.xC8 IBM Informix IDS 10.00.xC7W1 IBM Informix IDS 10.00.xC11 IBM Informix IDS 10.00.xC10 IBM Informix IDS 10.00.TC9 IBM Informix IDS 10.0.xC4 IBM Informix IDS 10.0 xC3 IBM Informix IDS 10.0
Not Vulnerable:

IBM Informix Dynamic Server DBINFO keyword Remote Stack Buffer Overflow Vulnerability

IBM Informix Dynamic Server is prone to a remote stack-based buffer-overflow vulnerability because it fails to perform adequate boundary-checks on user-supplied data before copying it into an insufficiently sized buffer.

An attacker can exploit this issue to execute arbitrary code within the context of the affected server. Failed exploit attempts will result in a denial-of-service condition.

IBM Informix Dynamic Server DBINFO keyword Remote Stack Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Informix Dynamic Server DBINFO keyword Remote Stack Buffer Overflow Vulnerability

Solution:
This issue has been fixed by the vendor. Please see the references for details.

IBM Informix Dynamic Server DBINFO keyword Remote Stack Buffer Overflow Vulnerability

References:

• IBM Homepage (IBM)
  
• IBM Informix Dynamic Server DBINFO Remote Code Execution Vulnerability (ZDI Disclosures)