IBM Informix Dynamic Server 12.10.x / 14.10.x < 14.10.xC13W13 / 15.0.x < 15.0.1.13 RCE (7282827)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(335412);
  script_version("1.2");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/17");

  script_cve_id("CVE-2026-13476");
  script_xref(name:"IAVA", value:"2026-A-0830");

  script_name(english:"IBM Informix Dynamic Server 12.10.x / 14.10.x < 14.10.xC13W13 / 15.0.x < 15.0.1.13 RCE (7282827)");

  script_set_attribute(attribute:"synopsis", value:
"A database server installed on the remote host is affected by a remote code execution vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of IBM Informix Dynamic Server installed on the remote host is 12.10.x, or 14.10.x prior to
14.10.xC13W13, or 15.0.x prior to 15.0.1.13. It is, therefore, affected by a remote code execution vulnerability in the
IBM Informix Wire Listener as referenced in the 7282827 vendor advisory.

  - IBM Informix Dynamic Server 14.10, 15.0, and 12.10 could allow an unauthenticated user to execute arbitrary
    commands with service account privileges on the system due to improper validation of user supplied input.
    (CVE-2026-13476)

Note that the vendor advisory lists the 12.10 branch as affected but does not name a fixed release for it. Refer to the
vendor advisory for guidance on that branch.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.ibm.com/support/pages/node/7282827");
  script_set_attribute(attribute:"solution", value:
"Upgrade to IBM Informix Dynamic Server 14.10.xC13W13 / 15.0.1.13 or later. For the 12.10 branch, refer to the vendor
advisory.");
  script_set_attribute(attribute:"agent", value:"all");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-13476");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/14");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:informix_dynamic_server");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("ibm_informix_server_installed.nasl", "ibm_informix_server_installed_nix.nbin");
  script_require_keys("installed_sw/IBM Informix Dynamic Server");

  exit(0);
}

include('vcf.inc');
include('smb_func.inc');

var win_local = FALSE;

if (get_kb_item('SMB/Registry/Enumerated')) win_local = TRUE;

var app_name = 'IBM Informix Dynamic Server';
var install = vcf::get_app_info(app:app_name, win_local:win_local);

var ver   = install['version'];
var path  = install['path'];
var fix = NULL;
var item = NULL;
var fixpack = 0;
var interim = 0;

# Affected branches per the advisory: 12.10, 14.10 and 15.0.
if (ver !~ "^12\.10($|[^0-9])" && ver !~ "^14\.10($|[^0-9])" && ver !~ "^15\.0($|[^0-9])")
  audit(AUDIT_INST_PATH_NOT_VULN, app_name, ver, path);

# https://www.ibm.com/support/pages/ibm-informix-version-number
if (ver =~ "^12\.10($|[^0-9])")
{
  # The advisory lists 12.10 as affected but names no fixed release for that branch.
  fix = 'See vendor advisory';
}
else if (ver =~ "^14\.10($|[^0-9])")
{
  item = pregmatch(pattern:"^14\.10\.[A-Za-z]*[cC]([0-9]+)([wW]([0-9]+))?", string:ver);
  if (!empty_or_null(item) && !empty_or_null(item[1]))
  {
    fixpack = int(item[1]);
    if (!empty_or_null(item[3]))
      interim = int(item[3]);

    if (fixpack < 13 || (fixpack == 13 && interim < 13))
      fix = '14.10.xC13W13';
  }
}
else if (ver =~ "^15\.0($|[^0-9])")
{
  # Informix 15.0 is versioned as a plain dotted release (e.g. 15.0.1.13).
  if (ver =~ "^[0-9]+(\.[0-9]+)*$" && ver_compare(ver:ver, fix:'15.0.1.13', strict:FALSE) < 0)
    fix = '15.0.1.13';
}

if (empty_or_null(fix))
  audit(AUDIT_INST_PATH_NOT_VULN, app_name, ver, path);

var port = 0;
if (win_local) port = kb_smb_transport();

var report =
  '\n  Path              : ' + path +
  '\n  Installed version : ' + ver +
  '\n  Fixed version     : ' + fix + '\n';

var server_instances = get_kb_item('Host/' + app_name + '/Server Instances');

if (!empty_or_null(server_instances))
{
  var instance_list = split(server_instances, sep:' / ', keep:FALSE);
  report += '  Server instances  : ' + '\n      - ' + join(instance_list, sep:'\n      - ') + '\n';
}

security_report_v4(severity:SECURITY_HOLE, port:port, extra:report);