CVE-2006-3853
CVSS5.1
发布时间 :2006-08-08 18:04:00
修订时间 :2011-03-07 21:39:36
NMCOPS    

[原文]Buffer overflow in IBM Informix Dynamic Server (IDS) before 9.40.TC7 and 10.00 before 10.00.TC3, when running on Windows, allows remote attackers to execute arbitrary code via a long username.


[CNNVD]Informix Dynamic Server windows环境任意代码执行漏洞(CNNVD-200608-125)

        Informix Dynamic Server(IDS)是一款由IBM开发的数据库。
        当运行windows时,允许远程攻击者执行任意代码利用一个长用户名.

- CVSS (基础分值)

CVSS分值: 5.1 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: HIGH [漏洞利用存在特定的访问条件]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:ibm:informix_dynamic_server:10.0.xc3IBM Informix IDS 10.0.xC3
cpe:/a:ibm:informix_dynamic_server:9.40.tc5IBM Informix IDS 9.40.TC5
cpe:/a:ibm:informix_dynamic_server:9.40.uc1IBM Informix IDS 9.40.UC1
cpe:/a:ibm:informix_dynamic_server:9.40.uc2IBM Informix IDS 9.40.UC2
cpe:/a:ibm:informix_dynamic_server:9.40.uc3IBM Informix IDS 9.40.UC3
cpe:/a:ibm:informix_dynamic_server:9.4IBM Informix IDS 9.4
cpe:/a:ibm:informix_dynamic_server:9.40.uc5IBM Informix IDS 9.40.UC5
cpe:/a:ibm:informix_dynamic_server:9.40.xc7IBM Informix IDS 9.40.xC7
cpe:/a:ibm:informix_dynamic_server:10.0IBM Informix Dynamic Server 10.0

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3853
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3853
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200608-125
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/xforce/xfdb/28122
(PATCH)  XF  informix-username-bo(28122)
http://www.securityfocus.com/bid/19264
(PATCH)  BID  19264
http://www-1.ibm.com/support/docview.wss?uid=swg21242921
(PATCH)  CONFIRM  http://www-1.ibm.com/support/docview.wss?uid=swg21242921
http://secunia.com/advisories/21301
(VENDOR_ADVISORY)  SECUNIA  21301
http://www.vupen.com/english/advisories/2006/3077
(UNKNOWN)  VUPEN  ADV-2006-3077
http://www.securityfocus.com/archive/1/archive/1/443149/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060814 Informix Long Username Buffer Overflow Vulnerability
http://www.securityfocus.com/archive/1/archive/1/443133/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060814 Informix - Discovery, Attack and Defense
http://www.osvdb.org/27685
(UNKNOWN)  OSVDB  27685
http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
(UNKNOWN)  MISC  http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf

- 漏洞信息

Informix Dynamic Server windows环境任意代码执行漏洞
中危 缓冲区溢出
2006-08-08 00:00:00 2006-08-15 00:00:00
远程※本地  
        Informix Dynamic Server(IDS)是一款由IBM开发的数据库。
        当运行windows时,允许远程攻击者执行任意代码利用一个长用户名.

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
        http://support.novell.com/security-alerts

- 漏洞信息 (F49294)

NISR02082006B.txt (PacketStormID:F49294)
2006-08-27 00:00:00
David Litchfield  ngssoftware.com
advisory,overflow
CVE-2006-3853,CVE-2006-3854
[点击下载]

NGSSoftware Insight Security Research Advisory - Informix Dynamic Server is a database developed by IBM. When IBM released a patch for the overly long username buffer overflow (CVE-2006-3853) it was discovered that the patch introduced a new buffer overflow vulnerability. Versions affected include 9.40.xC7 and xC8, 10.00.xC3 and xC4.

NGSSoftware Insight Security Research Advisory

Name: Error logging buffer overflow in Informix
Systems Affected: Informix 9.40.xC7 and xC8, 10.00.xC3 and xC4
Severity: Critical
Vendor URL: http://www.ibm.com/
Author: David Litchfield [ davidl@ngssoftware.com ]
Date of Public Advisory: 2nd August 2006
Advisory number: #NISR02082006B
CVEID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3854
Advisory URL: http://www.ngssoftware.com/research/

Description
***********
Informix Dynamic Server is a database developed by IBM. When IBM released a 
patch for the overly long username buffer overflow (CVE-2006-3853) it was 
discovered that the patch introduced a new buffer overflow vulnerability.


Details
*******
If the username is longer than 32 bytes an error is logged. A message ("%s : 
username is longer than usersize(32).") is logged with a call to 
_mt_logprintf(). _mt_logprintf() creates a 960 byte buffer on the stack and 
then passes this as argument for the destination in a call to vsprintf(). 
Thus if the username is longer than 960 bytes it is possible to overflow the 
buffer, overwriting the saved return address, gaining control of the 
process' path of execution.


Fix Information
***************
IBM was alerted to this flaw on the 21st July 2006; a fix has now been made 
available - both 9.40.xC9 and 10.00.xC5 fix this issue.

NGSSQuirreL for Informix, an advanced vulnerability assessment scanner 
designed specifically for Informix, can be used to accurately determine 
whether your servers are vulnerable to this flaw. More information about 
NGSSQuirreL for Informix can be found here 
http://www.ngssoftware.com/products/database-security/ngs-squirrel-informix.php

About NGSSoftware
*****************

NGSSoftware develops vulnerability assessment and compliancy tools for 
database servers including Oracle, Microsoft SQL Server, DB2, Sybase and 
Informix. Headquartered in the United Kingdom NGS has offices in London, St. 
Andrews (UK), Sydney, Brisbane, and Perth (Australia) and Texas in the 
United States; NGSConsulting provide services to some of the largest and 
most demanding organizations around the globe.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com


    

- 漏洞信息 (F49293)

NISR02082006A.txt (PacketStormID:F49293)
2006-08-27 00:00:00
David Litchfield  ngssoftware.com
advisory,overflow
CVE-2006-3853
[点击下载]

NGSSoftware Insight Security Research Advisory - When an Informix server logs on a user it copies the username to a 260 byte stack based buffer without first verifying its length. An attacker can exploit this by overflowing this buffer to overwrite the saved return address on the stack and thus redirect the process' path of execution to a location of their choosing. Versions 9.40.xC6 and below are affected. Versions 10.00.xC2 and below are affected.

NGSSoftware Insight Security Research Advisory

Name: Informix Long Username Buffer Overflow Vulnerability
Systems Affected: Informix 9.40.xC6 and earlier, 10.00.xC2 and earlier
Severity: Critical
Vendor URL: http://www.ibm.com/
Author: David Litchfield [ davidl@ngssoftware.com ]
Date of Public Advisory: 2nd August 2006
Advisory number: #NISR02082006A
CVEID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3853
Advisory URL: http://www.ngssoftware.com/research/

Description
***********
Informix Dynamic Server is a database developed by IBM. During a security 
assessment of the database it was found to be vulnerable to a stack based 
buffer overflow in the authentication procedure.

Details
*******
When an Informix server logs on a user it copies the username to a 260 byte 
stack based buffer without first verifying its length. An attacker can 
exploit this by overflowing this buffer to overwrite the saved return 
address on the stack and thus redirect the process' path of execution to a 
location of their choosing.

Whilst the IBM advisory indicates that only Informix running on Windows is 
vulnerable to this NGS we're able to determine that Informix running on 
Linux is also vulnerable.

Fix Information
***************
IBM was alerted to this flaw on the 6th January 2005; a fix has now been 
made available. IBM's advisory on the matter can be found here: 
http://www-1.ibm.com/support/docview.wss?uid=swg21242921

NGSSQuirreL for Informix, an advanced vulnerability assessment scanner 
designed specifically for Informix, can be used to accurately determine 
whether your servers are vulnerable to this flaw. More information about 
NGSSQuirreL for Informix can be found here 
http://www.ngssoftware.com/products/database-security/ngs-squirrel-informix.php

About NGSSoftware
*****************

NGSSoftware develops vulnerability assessment and compliancy tools for 
database servers including Oracle, Microsoft SQL Server, DB2, Sybase and 
Informix. Headquartered in the United Kingdom NGS has offices in London, St. 
Andrews (UK), Sydney, Brisbane, and Perth (Australia) and Texas in the 
United States; NGSConsulting provide services to some of the largest and 
most demanding organizations around the globe.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com


    

- 漏洞信息

27685
IBM Informix Dynamic Server on Windows username Overflow
Location Unknown Input Manipulation
Loss of Integrity
Exploit Unknown

- 漏洞描述

Informix Dynamic Server contains an unspecified flaw related to an overflow in the handling of Windows usernames that may allow an attacker to execute arbitrary code. No further details have been provided.

- 时间线

2006-07-31 2005-01-06
Unknow Unknow

- 解决方案

Upgrade to version 9.40.TC7, 10.00.TC3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

- 漏洞信息

IBM Informix Dynamic Server Multiple Vulnerabilities
Unknown 19264
Yes Yes
2006-07-31 12:00:00 2006-08-15 12:55:00
David Litchfield and the team at Next Generation Security Software (NGSS) are credited with the discovery of these issues.

- 受影响的程序版本

IBM Informix IDS 9.40 .UC3
IBM Informix IDS 9.40 .UC2
IBM Informix IDS 9.40 .UC1
IBM Informix IDS 9.40.UC5
IBM Informix IDS 9.40.TC5
IBM Informix IDS 9.40
IBM Informix IDS 9.4
IBM Informix IDS 7.31 .xD8
IBM Informix IDS 7.3
IBM Informix IDS 10.0 xC3
IBM Informix IDS 10.0
IBM Informix IDS 9.40.xD8
IBM Informix IDS 7.31 .xD9
IBM Informix IDS 10.0.xC4

- 不受影响的程序版本

IBM Informix IDS 9.40.xD8
IBM Informix IDS 7.31 .xD9
IBM Informix IDS 10.0.xC4

- 漏洞讨论

IBM Informix Dynamic Server is prone to multiple vulnerabilities. These issues can allow attackers to execute arbitrary code and compromise a vulnerable computer, gain elevated privileges, retrieve sensitive information, and trigger denial-of-service conditions.

Some of these issues are remote in nature, while others present a local threat.

- 漏洞利用

Several of these issues do not require specific exploit code.

Proof-of-concept exploit code is available from the referenced PDF document called "Informix: Discovery, Attack, and Defense".

- 解决方案

IBM has released IBM Informix Dynamic Server versions 7.31.xD9, 9.40.xD8, 10.00.xC4 to address these issues. Please contact the vendor to obtain fixes.

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站