20040129 ----------========== OPEN3S-2003-08-08-eng-informix-ontapemailing list
http://marc.info/?l=bugtraq&m=107539878804074&w=2 CVE-2004-2131
IBM Informix Dynamic Server 9.40/Informix Extended Parallel Server 8.40 - Multiple Vulnerabilities (1)
Record summary
CVE-2004-2131 has a selected CVSS score of 7.2; EIP currently links 2 catalogued exploits.
Description
Stack-based buffer overflow in ontape for IBM Informix Dynamic Server (IDS) 9.40.xC3 and earlier allows local users, with DSA privileges, to execute arbitrary code via a long ONCONFIG environment variable.
Description source: CVE List
Exploitation context
Available material
- Catalogued exploits
- 2
Proofs of concept
2Catalogued exploits
ExploitDBIBM Informix Dynamic Server 9.40/Informix Extended Parallel Server 8.40 - Multiple Vulnerabilities (1)ExploitDB exploitby paskNot analyzed1 file
ExploitDBIBM Informix Dynamic Server 9.40/Informix Extended Parallel Server 8.40 - Multiple Vulnerabilities (2)ExploitDB exploitby paskNot analyzed1 file
References
710737Third-party advisory
http://secunia.com/advisories/10737 www-1.ibm.comConfirmation
http://www-1.ibm.com/support/docview.wss?uid=swg21153336 3759vdb entry
http://www.osvdb.org/3759 9512vdb entry
http://www.securityfocus.com/bid/9512 informix-ontape-binary-bo(14970)vdb entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/14970 nvd.nist.gov
https://nvd.nist.gov/vuln/detail/CVE-2004-2131