CVE-2006-3858
CVSS2.1
发布时间 :2006-08-08 18:04:00
修订时间 :2011-03-07 21:39:36
NMCOP    

[原文]IBM Informix Dynamic Server (IDS) before 9.40.xC8 and 10.00 before 10.00.xC4 stores passwords in plaintext in shared memory, which allows local users to obtain passwords by reading the memory (product defects 171893, 171894, 173772).


[CNNVD]Informix Dynamic Server共享内存密码泄露漏洞(CNNVD-200608-115)

        Informix Dynamic Server(IDS)是一款由IBM开发的数据库。
        当用户登录到Informix服务器时会在共享内存部分找到明文口令。在Windows上"everyone"都可以打开这部分内存,读取内容,访问所有登录用户的口令。在Linux和Windows上如果出现崩溃的话,共享内存都会被dump到完全可读的日志文件。

- CVSS (基础分值)

CVSS分值: 2.1 [轻微(LOW)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: NONE [不会对系统完整性产生影响]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:ibm:informix_dynamic_server:10.0.xc3IBM Informix IDS 10.0.xC3
cpe:/a:ibm:informix_dynamic_server:10.0.xc1IBM Informix IDS 10.0.xC1
cpe:/a:ibm:informix_dynamic_server:9.40.xc5IBM Informix IDS 9.40.xC5
cpe:/a:ibm:informix_dynamic_server:9.40.tc5IBM Informix IDS 9.40.TC5
cpe:/a:ibm:informix_dynamic_server:9.40.uc1IBM Informix IDS 9.40.UC1
cpe:/a:ibm:informix_dynamic_server:9.40.uc2IBM Informix IDS 9.40.UC2
cpe:/a:ibm:informix_dynamic_server:9.40.uc3IBM Informix IDS 9.40.UC3
cpe:/a:ibm:informix_dynamic_server:9.4IBM Informix IDS 9.4
cpe:/a:ibm:informix_dynamic_server:9.40.uc5IBM Informix IDS 9.40.UC5
cpe:/a:ibm:informix_dynamic_server:9.40.xc7IBM Informix IDS 9.40.xC7
cpe:/a:ibm:informix_dynamic_server:10.0IBM Informix Dynamic Server 10.0

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3858
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3858
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200608-115
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/xforce/xfdb/28132
(PATCH)  XF  informix-plaintext-password(28132)
http://www.securityfocus.com/bid/19264
(PATCH)  BID  19264
http://www-1.ibm.com/support/docview.wss?uid=swg21242921
(PATCH)  CONFIRM  http://www-1.ibm.com/support/docview.wss?uid=swg21242921
http://secunia.com/advisories/21301
(VENDOR_ADVISORY)  SECUNIA  21301
http://www.vupen.com/english/advisories/2006/3077
(UNKNOWN)  VUPEN  ADV-2006-3077
http://www.securityfocus.com/archive/1/archive/1/443195/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060814 Multiple Password Exposures Flaws
http://www.securityfocus.com/archive/1/archive/1/443133/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060814 Informix - Discovery, Attack and Defense
http://www.osvdb.org/27691
(UNKNOWN)  OSVDB  27691
http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
(UNKNOWN)  MISC  http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf

- 漏洞信息

Informix Dynamic Server共享内存密码泄露漏洞
低危 资料不足
2006-08-08 00:00:00 2006-08-15 00:00:00
远程※本地  
        Informix Dynamic Server(IDS)是一款由IBM开发的数据库。
        当用户登录到Informix服务器时会在共享内存部分找到明文口令。在Windows上"everyone"都可以打开这部分内存,读取内容,访问所有登录用户的口令。在Linux和Windows上如果出现崩溃的话,共享内存都会被dump到完全可读的日志文件。

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
        http://support.novell.com/security-alerts

- 漏洞信息 (F49297)

NISR02082006E.txt (PacketStormID:F49297)
2006-08-27 00:00:00
David Litchfield  ngssoftware.com
advisory
linux,windows
CVE-2006-3858
[点击下载]

NGSSoftware Insight Security Research Advisory - Informix Dynamic Server is a database developed by IBM. During a security assessment of Informix multiple password exposure flaws were discovered. When a user logs on to an Informix server their cleartext password can be found in a shared memory section. On Windows "everyone" can open the section and read the contents and thus gain access to the passwords for every logged on user. On both Linux and Windows, in the event of a crash the share memory is dumped in a log file which is world readable. All versions are affected.

NGSSoftware Insight Security Research Advisory

Name: Multiple Password Exposures Flaws
Systems Affected: All versions of Informix
Severity: High
Vendor URL: http://www.ibm.com/
Author: David Litchfield [ davidl@ngssoftware.com ]
Date of Public Advisory: 2nd August 2006
Advisory number: #NISR02082006E
CVEID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3858
Advisory URL: http://www.ngssoftware.com/research/

Description
***********
Informix Dynamic Server is a database developed by IBM. During a security 
assessment of Informix multiple password exposure flaws were discovered.


Details
*******
When a user logs on to an Informix server their cleartext password can be 
found in a shared memory section. On Windows "everyone" can open the section 
and read the contents and thus gain access to the passwords for every logged 
on user. On both Linux and Windows, in the event of a crash the share memory 
is dumped in a log file which is world readable.

Fix Information
***************
IBM was alerted to these flaws on the 10th January 2005. Patches have now 
been made available.

NGSSQuirreL for Informix, an advanced vulnerability assessment scanner 
designed specifically for Informix, can be used to accurately determine 
whether your servers are vulnerable to this flaw. More information about 
NGSSQuirreL for Informix can be found here 
http://www.ngssoftware.com/products/database-security/ngs-squirrel-informix.php

About NGSSoftware
*****************

NGSSoftware develops vulnerability assessment and compliancy tools for 
database servers including Oracle, Microsoft SQL Server, DB2, Sybase and 
Informix. Headquartered in the United Kingdom NGS has offices in London, St. 
Andrews (UK), Sydney, Brisbane, and Perth (Australia) and Texas in the 
United States; NGSConsulting provide services to some of the largest and 
most demanding organizations around the globe.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com


    

- 漏洞信息

27691
IBM Informix Dynamic Server Shared Memory Cleartext Password Disclosure
Local Access Required Cryptographic, Information Disclosure
Loss of Confidentiality
Exploit Unknown

- 漏洞描述

Informix Dynamic Server contains a flaw that may lead to an unauthorized password exposure. It is possible to gain access to cleartext passwords because they are stored unencrypted in shared memory, which may lead to a loss of confidentiality.

- 时间线

2006-07-31 2005-01-06
Unknow Unknow

- 解决方案

Upgrade to version 7.31.xD9, 9.40.xC8, 10.00.xC4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站