IBM Informix Dynamic Server多个函数任意文件重写漏洞

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1193814 漏洞类型 未知
发布时间 2006-08-16 更新时间 2006-08-16
CVE编号 CVE-2006-3859 CNNVD-ID CNNVD-200608-252
漏洞平台 N/A CVSS评分 4.0
|漏洞来源
https://www.securityfocus.com/bid/82795
https://cxsecurity.com/issue/WLB-2006080117
http://www.cnnvd.org.cn/web/xxk/ldxqById.tag?CNNVD=CNNVD-200608-252
|漏洞详情
IBMInformix动态服务器(IDS)允许远程认证用户借助:(1)LOTOFILE函数和(2)trl_tracefile_set函数,以及(3)"SETDEBUGFILE"指令创建并覆盖任意文件。
|漏洞EXP
NGSSoftware Insight Security Research Advisory

Name: Multiple Arbitrary File Access (Write/Read) Vulnerabilities
Systems Affected: All version of Informix
Severity: High
Vendor URL: http://www.ibm.com/
Author: David Litchfield [ davidl (at) ngssoftware (dot) com [email concealed] ]
Date of Public Advisory: 2nd August 2006
Advisory number: #NISR02082006I
CVEID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3859
Advisory URL: http://www.ngssoftware.com/research/

Description
***********
Informix Dynamic Server is a database developed by IBM. During a security 
assessment of Informix multiple file creation/write/read issues were 
discovered.

Details
*******
The LOTOFILE function and rlt_tracefile_set functions can be used to create 
and write to files. The SET DEBUG FILE can also be used to create and write 
to files.

Fix Information
***************
IBM was alerted to this flaw on the 6th January 2005. Patches have now been 
made available; further a workaround is to revoke public execute permission 
of the functions involved. There is no workaround for the set debug file.

NGSSQuirreL for Informix, an advanced vulnerability assessment scanner 
designed specifically for Informix, can be used to accurately determine 
whether your servers are vulnerable to this flaw. More information about 
NGSSQuirreL for Informix can be found here 
http://www.ngssoftware.com/products/database-security/ngs-squirrel-infor
mix.php

About NGSSoftware
*****************

NGSSoftware develops vulnerability assessment and compliancy tools for 
database servers including Oracle, Microsoft SQL Server, DB2, Sybase and 
Informix. Headquartered in the United Kingdom NGS has offices in London, St. 
Andrews (UK), Sydney, Brisbane, and Perth (Australia) and Texas in the 
United States; NGSConsulting provide services to some of the largest and 
most demanding organizations around the globe.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries (at) ngssoftware (dot) com [email concealed]
|受影响的产品
IBM Informix Dynamic Database Server 9.40.tc8 IBM Informix Dynamic Database Server 9.40.tc7 IBM Informix Dynamic Database Server 10.00.tc5 IBM Informix Dynamic Database Server 10.00.tc4
|参考资料

来源:BUGTRAQ
名称:20060814MultipleArbitraryFileAccess(Write/Read)Vulnerabilities
链接:http://www.securityfocus.com/archive/1/archive/1/443216/100/0/threaded
来源:BUGTRAQ
名称:20060814Informix-Discovery,AttackandDefense
链接:http://www.securityfocus.com/archive/1/archive/1/443133/100/0/threaded
来源:MISC
链接:http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
来源:XF
名称:informix-lotofile-file-create(28383)
链接:http://xforce.iss.net/xforce/xfdb/28383
来源:SREASON
名称:1408
链接:http://securityreason.com/securityalert/1408