CVE-2006-3862 - Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC5 through 9.40.xC7 and 10.00.TC1 through

CVE-2006-3862

Summary

Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC5 through 9.40.xC7 and 10.00.TC1 through 10.00.xC3 allows attackers to execute arbitrary code via the SQLIDEBUG environment variable (envariable). This vulnerability is addressed in the following product releases: IBM, Informix IDS, 9.40 xC7 IBM, Informix IDS, 10.00 xC3

References

Vulnerable Configurations

cpe:2.3:a:ibm:informix_dynamic_server:9.40.tc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.tc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.xc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:9.40.xc5:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0.tc1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0.tc1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0.xc1:*:*:*:*:*:*:*
cpe:2.3:a:ibm:informix_dynamic_server:10.0.xc1:*:*:*:*:*:*:*

CVSS

Base:	7.5 (as of 17-10-2018 - 21:32)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	LOW	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:L/Au:N/C:P/I:P/A:P

refmap via4

bid	19264
bugtraq	20060814 Informix - Discovery, Attack and Defense 20060814 SQLIDEBUG envariable overflow on Informix
confirm	http://www-1.ibm.com/support/docview.wss?uid=swg21242921
misc	http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
osvdb	27694
secunia	21301
vupen	ADV-2006-3077
xf	informix-sqlidebug-bo(28158)

Last major update

17-10-2018 - 21:32

Published

08-08-2006 - 22:04

Last modified

17-10-2018 - 21:32