CVE-2002-0905

IBM Informix SE-7.25 - Local Buffer Overflow via INFORMIXDIR Environment Variable

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 2 public exploits for CVE-2002-0905. PoCs published by pHrail, smurf.

AI-analyzed exploit summary This exploit leverages a buffer overflow in the INFORMIXDIR environment variable handled by the setuid root binary `sqlexec` in Informix-SE for Linux. It provides multiple return address options and brute-forcing capabilities to achieve local privilege escalation to root.

Description

Buffer overflow in sqlexec for Informix SE-7.25 allows local users to gain root privileges via a long INFORMIXDIR environment variable.

Exploits (2)

exploitdb WORKING POC VERIFIED
by pHrail · perllocallinux
https://www.exploit-db.com/exploits/21497

This exploit leverages a buffer overflow in the INFORMIXDIR environment variable handled by the setuid root binary `sqlexec` in Informix-SE for Linux. It provides multiple return address options and brute-forcing capabilities to achieve local privilege escalation to root.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: IBM Informix-SE 7.25.UC1 for Linux
No auth needed
Prerequisites: Local access to the vulnerable system · Presence of the vulnerable `sqlexec` binary · GDB installed for return address calculation
devstral-2 · analyzed Feb 16, 2026 Full analysis →
exploitdb WORKING POC VERIFIED
by smurf · clocallinux
https://www.exploit-db.com/exploits/21496

This exploit leverages a buffer overflow in the INFORMIXDIR environment variable handled by the setuid root executable `sqlexec` in Informix-SE for Linux. It overwrites the return address to execute shellcode, granting root privileges.

Classification
Working Poc 95%
Attack Type
Lpe
Complexity
Moderate
Reliability
Reliable
Target: IBM Informix-SE 7.25 for Linux
No auth needed
Prerequisites: Access to a vulnerable Linux system with Informix-SE 7.25 installed · Ability to execute the `sqlexec` binary
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (3)

Core 3
Core References
Exploit, Vendor Advisory vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/4891
Third Party Advisory mailing-list x_refsource_bugtraq
http://archives.neohapsis.com/archives/bugtraq/2002-05/0270.html
Vendor Advisory vdb-entry x_refsource_xf
http://www.iss.net/security_center/static/9219.php

Scores

EPSS 0.0107
EPSS Percentile 60.6%

Details

Status published
Products (3)
ibm/informix 7.25_.uc1_se
ibm/informix 7.25_.uc2_se
ibm/informix 7.25_.uc3_se
Published Oct 04, 2002
Tracked Since Feb 18, 2026