IBM Informix Dynamic Server 'oninit.exe' Buffer Overflow Vulnerability

Bugtraq ID:	44192
Class:	Boundary Condition Error
CVE:
Remote:	Yes
Local:	No
Published:	Oct 18 2010 12:00AM
Updated:	Oct 18 2010 12:00AM
Credit:	anonymous
Vulnerable:	IBM Informix IDS 11.50.xC1 IBM Informix IDS 11.50 IBM Informix IDS 11.10.xC2W2 IBM Informix IDS 11.10.xC2 IBM Informix IDS 11.10.TC3 IBM Informix IDS 11.10
Not Vulnerable:

IBM Informix Dynamic Server 'oninit.exe' Buffer Overflow Vulnerability

IBM Informix is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue may allow an attacker to execute arbitrary code with SYSTEM-level privileges, completely compromising affected computers. Failed exploit attempts will result in a denial-of-service condition.

IBM Informix Dynamic Server 'oninit.exe' Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Informix Dynamic Server 'oninit.exe' Buffer Overflow Vulnerability

Solution:
Vendor updates are available. Please see the referenced advisories for more information.

IBM Informix Dynamic Server 'oninit.exe' Buffer Overflow Vulnerability

References:

• IBM Homepage (IBM)
  
• ZDI-10-216 IBM Informix Dynamic Server oninit.exe EXPLAIN Remote Code Execution (Zero Day Initiative)