IBM Informix Multiple Local Privilege Escalation Vulnerabilities

Bugtraq ID:	9511
Class:	Unknown
CVE:
Remote:	No
Local:	Yes
Published:	Jan 27 2004 12:00AM
Updated:	Jan 27 2004 12:00AM
Credit:	The disclosure of these issues has been credited to KF <[email protected]>.
Vulnerable:	IBM Informix IDS 9.40 .UC2 IBM Informix IDS 9.40 .UC1 IBM Informix Extended Parallel Server 8.40 .UC2 IBM Informix Extended Parallel Server 8.40 .UC1
Not Vulnerable:	IBM Informix IDS 9.40 .UC3 IBM Informix Extended Parallel Server 8.40 .UD1

IBM Informix Multiple Local Privilege Escalation Vulnerabilities

Multiple vulnerabilities have been found in the IBM Informix Dymanic Server and Informix Extended Parallel Server that may allow a malicious user to gain escalated privileges on a local machine. It has been reported that the individual vulnerabilities exist in multiple setuid and setgid binaries that are included with the Informix software.

IBM Informix Dynamic Server 9.40.UC2 and earlier and IBM Informix Extended Parallel Server versions prior to 8.40.UD1 have been reported to be vulnerable to these issues.

IBM Informix Multiple Local Privilege Escalation Vulnerabilities

The researchers who discovered these issues have developed proof of concept exploits. These exploits have not been released at the moment.

IBM Informix Multiple Local Privilege Escalation Vulnerabilities

Solution:
IBM has fixed these issues in IBM Informix Dynamic Server and IBM Informix Extended Parallel Server. Users running IBM Informix Dynamic Server 9.40.UC2 or earlier are advised to upgrade to IBM Informix Dynamic Server 9.40.UC3. Users running IBM Informix Extended Parallel Server version prior to 8.40.UD1 are advised to upgrade to IBM Informix Extended Parallel Server 8.40.UD1. Please contact the vendor in order to obtain fixes.

IBM Informix Multiple Local Privilege Escalation Vulnerabilities

References:

• Security issues in IBM Informix Dynamic Server and IBM Informix (XPS) (IBM)