IBM Informix symbolic links security vulnerability

On installation /tmp/installserver.txt file is insecurely created...

[Full-disclosure] IBM Informix Dynamic Server V10.0 File Clobbering during Install

IBM Informix IDS V10.0 File Clobbering during Install 10/1/2006 Overview From the Website http://www-306.ibm.com/software/data/informix/ids/ "IBM Informixr Dynamic Server IDS is a strategic data server in the IBM Information Management Software portfolio that provides blazing online transaction...

CVE-2006-3859

IBM Informix Dynamic Server IDS allows remote authenticated users to create and overwrite arbitrary files via the 1 LOTOFILE and 2 trltracefileset functions, and the 3 "SET DEBUG FILE" commands...

CVE-2006-3854

Buffer overflow in IBM Informix Dynamic Server IDS 9.40.TC7, 9.40.TC8, 10.00.TC4, and 10.00.TC5, when running on Windows, allows remote attackers to execute arbitrary code via a long username, which causes an overflow in vsprintf when displaying in the resulting error message. NOTE: this issue is...

CVE-2006-3860

IBM Informix Dynamic Server IDS before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary commands via the 1 "SET DEBUG FILE" SQL command, and the 2 startonpload and 3 dbexp functions...

CVE-2006-3854

Buffer overflow in IBM Informix Dynamic Server IDS 9.40.TC7, 9.40.TC8, 10.00.TC4, and 10.00.TC5, when running on Windows, allows remote attackers to execute arbitrary code via a long username, which causes an overflow in vsprintf when displaying in the resulting error message. NOTE: this issue is...

CVE-2006-3860

IBM Informix Dynamic Server IDS before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary commands via the 1 "SET DEBUG FILE" SQL command, and the 2 startonpload and 3 dbexp functions...

CVE-2006-3859

IBM Informix Dynamic Server IDS allows remote authenticated users to create and overwrite arbitrary files via the 1 LOTOFILE and 2 trltracefileset functions, and the 3 "SET DEBUG FILE" commands...

CVE-2006-3854

CVE-2006-3854 affects IBM Informix Dynamic Server (IDS) on Windows: IDS 9.40.TC7/TC8 and 10.00.TC4/TC5 are vulnerable to a buffer overflow caused by a long username that overflows a vsprintf-based error message, enabling remote arbitrary code execution. The issue is noted as stemming from an inco...

Informix Detection

The remote host is running Informix, an online transaction processing OLTP data server from IBM. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include"compat.inc"; if description scriptid22228; scriptversion"1.18";...

CVE-2006-3855

The ifxloadinternal function in IBM Informix Dynamic Server IDS allows remote authenticated users to execute arbitrary C code via the DllMain or init function in a library, aka "C code UDR."...

CVE-2006-3857

Multiple buffer overflows in IBM Informix Dynamic Server IDS before 9.40.TC6 and 10.00 before 10.00.TC3 allow remote authenticated users to execute arbitrary code via 1 the getname function, as used by a sqremview, b sqremproc, c sqremperms, d sqdistfetch, and e sqdcatalog; and the 2 SET DEBUG...

CVE-2006-3858

IBM Informix Dynamic Server IDS before 9.40.xC8 and 10.00 before 10.00.xC4 stores passwords in plaintext in shared memory, which allows local users to obtain passwords by reading the memory product defects 171893, 171894, 173772...

CVE-2006-3853

Buffer overflow in IBM Informix Dynamic Server IDS before 9.40.TC7 and 10.00 before 10.00.TC3, when running on Windows, allows remote attackers to execute arbitrary code via a long username...

CVE-2006-3862

Buffer overflow in IBM Informix Dynamic Server IDS 9.40.TC5 through 9.40.xC7 and 10.00.TC1 through 10.00.xC3 allows attackers to execute arbitrary code via the SQLIDEBUG environment variable envariable...

CVE-2006-3861

IBM Informix Dynamic Server IDS before 9.40.xC7 and 10.00 before 10.00.xC3 does not use database creation permissions, which allows remote authenticated users to create arbitrary databases...

CVE-2006-3862

CVE-2006-3862: Buffer overflow in IBM Informix Dynamic Server (IDS) allowing arbitrary code execution via the SQLIDEBUG environment variable. Affected versions: IDS 9.40.TC5–9.40.xC7 and 10.00.TC1–10.00.xC3. Exploitation status is not stated in the provided documents; no remediation details are g...

CVE-2006-3857

Multiple buffer overflows in IBM Informix Dynamic Server IDS before 9.40.TC6 and 10.00 before 10.00.TC3 allow remote authenticated users to execute arbitrary code via 1 the getname function, as used by a sqremview, b sqremproc, c sqremperms, d sqdistfetch, and e sqdcatalog; and the 2 SET DEBUG...

CVE-2006-3853

Buffer overflow in IBM Informix Dynamic Server IDS before 9.40.TC7 and 10.00 before 10.00.TC3, when running on Windows, allows remote attackers to execute arbitrary code via a long username...

CVE-2006-3855

The ifxloadinternal function in IBM Informix Dynamic Server IDS allows remote authenticated users to execute arbitrary C code via the DllMain or init function in a library, aka "C code UDR."...