CVE-2006-3858 - IBM Informix Dynamic Server (IDS) before 9.40.xC8 and 10.00 before 10.00.xC4 stores passwords in pla

CVE-2006-3858

Summary

IBM Informix Dynamic Server (IDS) before 9.40.xC8 and 10.00 before 10.00.xC4 stores passwords in plaintext in shared memory, which allows local users to obtain passwords by reading the memory (product defects 171893, 171894, 173772). This vulnerability is addressed in the following product releases: IBM, Informix IDS, 9.40 xC8 IBM, Informix IDS, 10.00 xC4

References

Vulnerable Configurations

cpe:2.3:a:ibm:informix_dynamic_server:9.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.4:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.tc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.tc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc2:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.xc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.xc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.xc7:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.xc7:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0.xc1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0.xc1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0.xc3:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0.xc3:*:*:*:*:*:*:*

CVSS

Base:	2.1 (as of 17-10-2018 - 21:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	NONE	NONE

cvss-vector via4

AV:L/AC:L/Au:N/C:P/I:N/A:N

refmap via4

bid	19264
bugtraq	20060814 Informix - Discovery, Attack and Defense 20060814 Multiple Password Exposures Flaws
confirm	http://www-1.ibm.com/support/docview.wss?uid=swg21242921
misc	http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
osvdb	27691
secunia	21301
vupen	ADV-2006-3077
xf	informix-plaintext-password(28132)

Last major update

17-10-2018 - 21:32

Published

08-08-2006 - 22:04

Last modified

17-10-2018 - 21:32