发布时间 :2006-08-08 18:04:00
修订时间 :2011-03-07 21:39:36

[原文]Multiple buffer overflows in IBM Informix Dynamic Server (IDS) before 9.40.TC6 and 10.00 before 10.00.TC3 allow remote authenticated users to execute arbitrary code via (1) the getname function, as used by (a) _sq_remview, (b) _sq_remproc, (c) _sq_remperms, (d) _sq_distfetch, and (e) _sq_dcatalog; and the (2) SET DEBUG FILE, (3) IFX_FILE_TO_FILE, (4) FILETOCLOB, (5) LOTOFILE, and (6) DBINFO functions (product defect IDs 171649, 171367, 171387, 171391, 171906, 172179).

[CNNVD]Informix Dynamic Server 多个SQL语句存在溢出漏洞(CNNVD-200608-109)

        Informix Dynamic Server(IDS)是一款由IBM开发的数据库。

- CVSS (基础分值)

CVSS分值: 6.5 [中等(MEDIUM)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: [--]

- CPE (受影响的平台与产品)

cpe:/a:ibm:informix_dynamic_database_server:9.40.tc3IBM Informix Dynamic Database Server 9.40.TC3
cpe:/a:ibm:informix_dynamic_database_server:9.40.uc1IBM Informix Dynamic Database Server 9.40.UC1
cpe:/a:ibm:informix_dynamic_database_server:9.40.tc5IBM Informix Dynamic Database Server 9.40.TC5
cpe:/a:ibm:informix_dynamic_database_server:9.40.uc2IBM Informix Dynamic Database Server 9.40.UC2
cpe:/a:ibm:informix_dynamic_database_server:10.00.tc2IBM Informix Dynamic Database Server 10.00.TC2
cpe:/a:ibm:informix_dynamic_database_server:9.3IBM Informix Dynamic Database Server 9.3
cpe:/a:ibm:informix_dynamic_database_server:9.40.uc3IBM Informix Dynamic Database Server 9.40.UC3
cpe:/a:ibm:informix_dynamic_database_server:9.40.tc2IBM Informix Dynamic Database Server 9.40.TC2
cpe:/a:ibm:informix_dynamic_database_server:9.40.tc1IBM Informix Dynamic Database Server 9.40.TC1
cpe:/a:ibm:informix_dynamic_database_server:10.00.tc1IBM Informix Dynamic Database Server 10.00.TC1
cpe:/a:ibm:informix_dynamic_database_server:9.40.tc4IBM Informix Dynamic Database Server 9.40.TC4

- OVAL (用于检测的技术细节)


- 官方数据库链接
(官方数据源) MITRE
(官方数据源) NVD
(官方数据源) CNNVD

- 其它链接及资源
(PATCH)  XF  informix-ifxfiletofile-bo(28157)
(PATCH)  XF  informix-getname-bo(28127)
(PATCH)  XF  informix-setdebugfile-bo(28126)
(PATCH)  XF  informix-filetoclob-buffer-overflow(28120)
(PATCH)  XF  informix-lotofile-bo(28119)
(PATCH)  XF  informix-dbinfo-bo(28118)
(PATCH)  BID  19264
(UNKNOWN)  VUPEN  ADV-2006-3077
(UNKNOWN)  BUGTRAQ  20060814 Multiple Buffer Overflow Vulnerabilities in Informix
(UNKNOWN)  BUGTRAQ  20060814 Informix - Discovery, Attack and Defense

- 漏洞信息

Informix Dynamic Server 多个SQL语句存在溢出漏洞
中危 缓冲区溢出
2006-08-08 00:00:00 2006-08-15 00:00:00
        Informix Dynamic Server(IDS)是一款由IBM开发的数据库。

- 公告与补丁


- 漏洞信息 (F49296)

NISR02082006D.txt (PacketStormID:F49296)
2006-08-27 00:00:00
David Litchfield

NGSSoftware Insight Security Research Advisory - Informix Dynamic Server is a database developed by IBM. During a security assessment of Informix multiple buffer overflow vulnerabilities were discovered that could be exploited via SQL or the protocol. All versions are affected.

NGSSoftware Insight Security Research Advisory

Name: Multiple Buffer Overflow Vulnerabilities in Informix
Systems Affected: All versions of Informix
Severity: High
Vendor URL:
Author: David Litchfield [ ]
Date of Public Advisory: 2nd August 2006
Advisory number: #NISR02082006D
Advisory URL:

Informix Dynamic Server is a database developed by IBM. During a security 
assessment of Informix multiple buffer overflow vulnerabilities were 
discovered that could be exploited via SQL or the protocol.


At the SQL level the following SQL statements are vulnerable to overflow.


At the protocol level, overflows were found in the following C functions


Each of these call the getname() function. The getname() function takes a 
source string and copies it to a destination buffer - much like strcpy().

Each of these overflows are trivially exploitable. All have been assigned to 

Further to these overflows, unhandled exceptions can be triggered with a 
NULL pointer in the _sq_scroll and _sq_bbind functions at the protocol 
level. Exploitation of these two flaws would result in a DoS condition. 
These two issues have been assigned to CVE-2006-3856.

Fix Information
IBM was alerted to these flaws between the 6th and the 18th January 2005. 
Patches have now been made available.

NGSSQuirreL for Informix, an advanced vulnerability assessment scanner 
designed specifically for Informix, can be used to accurately determine 
whether your servers are vulnerable to this flaw. More information about 
NGSSQuirreL for Informix can be found here

About NGSSoftware

NGSSoftware develops vulnerability assessment and compliancy tools for 
database servers including Oracle, Microsoft SQL Server, DB2, Sybase and 
Informix. Headquartered in the United Kingdom NGS has offices in London, St. 
Andrews (UK), Sydney, Brisbane, and Perth (Australia) and Texas in the 
United States; NGSConsulting provide services to some of the largest and 
most demanding organizations around the globe.

Telephone +44 208 401 0070
Fax +44 208 401 0076


- 漏洞信息

IBM Informix Dynamic Server FILETOCLOB() Function Overflow
Location Unknown Input Manipulation
Loss of Integrity
Exploit Unknown

- 漏洞描述

Informix Dynamic Server contains an unspecified flaw related to an overflow in the FILETOCLOB() function that may allow an attacker to execute arbitrary code. No further details have been provided.

- 时间线

2006-07-31 2005-01-06
Unknow Unknow

- 解决方案

Upgrade to version 9.40.xC7, 10.00.xC3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者