155 matches found
Information disclosure
onedcu in IBM Informix Dynamic Server IDS 10.x before 10.00.xC8 allows local users to create arbitrary files via the Trace file argument...
CVE-2008-0368
onedcu in IBM Informix Dynamic Server IDS 10.x before 10.00.xC8 allows local users to create arbitrary files via the Trace file argument...
CVE-2008-0369
Multiple unspecified programs in IBM Informix Dynamic Server IDS 10.x before 10.00.xC8 allow local users to create arbitrary files by specifying the target file in the SQLIDEBUG environment variable, whose ownership is changed to the user invoking the programs...
CVE-2007-5957
Unspecified vulnerability in IBM Informix Dynamic Server IDS 10.00.TC3TL and 11.10.TB4TL on Windows allows attackers to cause a denial of service application crash via unspecified SQONASSIST requests...
Directory traversal
Directory traversal vulnerability in IBM Informix Dynamic Server IDS before 10.00.xC7W1 allows local users to gain privileges by referencing modified NLS message files through directory traversal sequences in the DBLANG environment variable...
iDefense Security Advisory 11.09.07: IBM Informix Dynamic Server DBLANG Directory Traversal Vulnerability
iDefense Security Advisory 11.09.07 http://labs.idefense.com/intelligence/vulnerabilities/ Nov 09, 2007 I. BACKGROUND IBM Corp.'s Informix Dynamic Server is an online transaction processing data server. It contains several set-uid root binaries. For more information, visit the product homepage at...
IBM Informix Dynamic Server privilege escalation
Directory traversal on DBLANG environment variable parsing allows to specify attacker-controlled NLS files, leading to possibility of format string attacks for suid applications...
IBM Informix Dynamic Server存在多个漏洞
IBM Informix Dynamic Server是一款多线索数据库服务器。 IBM Informix Dynamic Server存在多个安全问题，远程攻击者可以利用漏洞获得敏感信息或者以进程权限执行任意代码。 具体问题包括： -LOTOFILE、DBINFO、FILETOCLOB、getname、ifxfiletofile函数缓冲区溢出。 -在sysmaster中通过dbimp和dbexp过程执行任意命令。 -windows版本上超长用户名缓冲区溢出。 -通过SET DEBUG FILE执行任意命令。 -SET DEBUG FILE缓冲区溢出 -通过C code UDR提权...
CVE-2006-5664
The installation script in IBM Informix Dynamic Server 10.00, Informix Client Software Development Kit CSDK 2.90, and Informix I-Connect 2.90 allows local users to "compromise security" via a symlink attack on temporary files...
CVE-2006-5163
IBM Informix Dynamic Server 10.UC3RC1 Trial for Linux and possibly other versions creates /tmp/installserver.txt with insecure permissions, which allows local users to append data to arbitrary files via a symlink attack...
CVE-2006-5163
IBM Informix Dynamic Server 10.UC3RC1 Trial for Linux and possibly other versions creates /tmp/installserver.txt with insecure permissions, which allows local users to append data to arbitrary files via a symlink attack...
CVE-2006-3859
IBM Informix Dynamic Server IDS allows remote authenticated users to create and overwrite arbitrary files via the 1 LOTOFILE and 2 trltracefileset functions, and the 3 "SET DEBUG FILE" commands...
CVE-2006-3860
IBM Informix Dynamic Server IDS before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary commands via the 1 "SET DEBUG FILE" SQL command, and the 2 startonpload and 3 dbexp functions...
CVE-2006-3860
IBM Informix Dynamic Server IDS before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary commands via the 1 "SET DEBUG FILE" SQL command, and the 2 startonpload and 3 dbexp functions...
CVE-2006-3854
Buffer overflow in IBM Informix Dynamic Server IDS 9.40.TC7, 9.40.TC8, 10.00.TC4, and 10.00.TC5, when running on Windows, allows remote attackers to execute arbitrary code via a long username, which causes an overflow in vsprintf when displaying in the resulting error message. NOTE: this issue is...
CVE-2006-3859
IBM Informix Dynamic Server IDS allows remote authenticated users to create and overwrite arbitrary files via the 1 LOTOFILE and 2 trltracefileset functions, and the 3 "SET DEBUG FILE" commands...
CVE-2006-3854
CVE-2006-3854 affects IBM Informix Dynamic Server (IDS) on Windows: IDS 9.40.TC7/TC8 and 10.00.TC4/TC5 are vulnerable to a buffer overflow caused by a long username that overflows a vsprintf-based error message, enabling remote arbitrary code execution. The issue is noted as stemming from an inco...
CVE-2006-3858
IBM Informix Dynamic Server IDS before 9.40.xC8 and 10.00 before 10.00.xC4 stores passwords in plaintext in shared memory, which allows local users to obtain passwords by reading the memory product defects 171893, 171894, 173772...