IBM Informix Dynamic Server Oninit Remote Code Execution Vulnerability

Bugtraq ID:	46230
Class:	Boundary Condition Error
CVE:	CVE-2011-1033
Remote:	Yes
Local:	No
Published:	Feb 07 2011 12:00AM
Updated:	Apr 13 2015 09:01PM
Credit:	anonymous
Vulnerable:	IBM Informix IDS 11.50.xC1 IBM Informix IDS 11.50 IBM Informix IDS 11.10.xC2W2 IBM Informix IDS 11.10.xC2 IBM Informix IDS 11.10.TC3 IBM Informix IDS 11.10
Not Vulnerable:	IBM Informix IDS 11.50.xC8

IBM Informix Dynamic Server Oninit Remote Code Execution Vulnerability

IBM Informix is prone to a remote code-execution vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Successfully exploiting this issue may allow an attacker to execute arbitrary code with SYSTEM-level privileges, completely compromising affected computers. Failed exploit attempts will result in a denial-of-service condition.

IBM Informix Dynamic Server Oninit Remote Code Execution Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM Informix Dynamic Server Oninit Remote Code Execution Vulnerability

Solution:
Reports indicate the vendor has released updates; this has not been confirmed. Please contact the vendor for more information.

IBM Informix Dynamic Server Oninit Remote Code Execution Vulnerability

References:

• IBM Homepage (IBM)
  
• ZDI-11-050 IBM Informix Dynamic Server SET ENVIRONMENT Remote Code Execution Vul (Zero Day Initiative)