Security Bulletin: Vulnerabilities in Informix Dynamic Server and Informix Open Admin Tool

Summary

IBM Informix Dynamic Server is vulnerable to Sweet32: Birthday attacks on 64-bit block ciphers in TLS. Both IBM Informix Dynamic Server and IBM Informix Server Open Admin Tool are vulnerable to a Remote Code Execution Vulnerability.

Vulnerability Details

CVEID: CVE-2016-2183**
DESCRIPTION:** OpenSSL could allow a remote attacker to obtain sensitive information, caused by an error in the DES/3DES cipher, used as a part of the SSL/TLS protocol. By capturing large amounts of encrypted traffic between the SSL/TLS server and the client, a remote attacker able to conduct a man-in-the-middle attack could exploit this vulnerability to recover the plaintext data and obtain sensitive information. This vulnerability is known as the SWEET32 Birthday attack.
CVSS Base Score: 3.7
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/116337 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N)

CVEID: CVE-2017-1092**
DESCRIPTION:** IBM Informix Open Admin Tool could allow an unauthorized user to execute arbitrary code as system admin on Windows servers.
CVSS Base Score: 9.8
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/120390 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

IBM Informix Dynamic Server v 11.50.xCn
IBM Informix Dynamic Server v 11.70.xCn
IBM Informix Dynamic Server v 12.10.xCn

Remediation/Fixes

| Version| Fix
—|—|—
IBM Informix Dynamix Server (including Open Admin Tool)| 12.10.xC8W2| Fix Central
IBM Informix Dynamix Server (including Open Admin Tool)| 11.70.xC9| Fix Central
IBM Informix Dynamix Server (including Open Admin Tool)| 11.50.xC9| Contact Support or upgrade to a version listed above.

Workarounds and Mitigations

None.