CVE-2006-3860
CVSS7.5
发布时间 :2006-08-16 21:04:00
修订时间 :2011-03-07 21:39:36
NMCOP    

[原文]IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 allows allows remote authenticated users to execute arbitrary commands via the (1) "SET DEBUG FILE" SQL command, and the (2) start_onpload and (3) dbexp functions.


[CNNVD]Informix Dynamic Server SET DEBUG FILE SQL语句任意命令执行漏洞(CNNVD-200608-246)

        Informix Dynamic Server(IDS)是一款由IBM开发的数据库
        攻击者可以向SET DEBUG FILE SQL语句和start_onpload及dbexp过程注入任意操作系统命令。注入到SET DEBUG FILE中的命令会以informix用户的权限执行;注入到dbexp或start_onpload中的命令会以登录用户的权限执行。
        

- CVSS (基础分值)

CVSS分值: 7.5 [严重(HIGH)]
机密性影响: PARTIAL [很可能造成信息泄露]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: PARTIAL [可能会导致性能下降或中断资源访问]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: [--]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

cpe:/a:ibm:informix_dynamic_database_server:9.40.uc5IBM Informix Dynamic Database Server 9.40.UC5
cpe:/a:ibm:informix_dynamic_database_server:10.0_xc3IBM Informix Dynamic Database Server 10.0 xC3
cpe:/a:ibm:informix_dynamic_database_server:9.40.uc1IBM Informix Dynamic Database Server 9.40.UC1
cpe:/a:ibm:informix_dynamic_database_server:9.40.tc5IBM Informix Dynamic Database Server 9.40.TC5
cpe:/a:ibm:informix_dynamic_database_server:10.0IBM Informix Dynamic Database Server 10.0
cpe:/a:ibm:informix_dynamic_database_server:9.40.uc2IBM Informix Dynamic Database Server 9.40.UC2
cpe:/a:ibm:informix_dynamic_database_server:7.3IBM Informix Dynamic Database Server 7.3
cpe:/a:ibm:informix_dynamic_database_server:9.40.uc3IBM Informix Dynamic Database Server 9.40.UC3
cpe:/a:ibm:informix_dynamic_database_server:9.4IBM Informix Dynamic Database Server 9.4
cpe:/a:ibm:informix_dynamic_database_server:7.31_.xd8IBM Informix Dynamic Database Server 7.31 .xD8
cpe:/a:ibm:informix_dynamic_database_server:9.40.xc7IBM Informix Dynamic Database Server 9.40 xC7

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3860
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3860
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200608-246
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/xforce/xfdb/28124
(UNKNOWN)  XF  informix-setdebug-command-execution(28124)
http://xforce.iss.net/xforce/xfdb/28121
(UNKNOWN)  XF  informix-sysmaster-command-execution(28121)
http://www.vupen.com/english/advisories/2006/3077
(UNKNOWN)  VUPEN  ADV-2006-3077
http://www.securityfocus.com/bid/19264
(UNKNOWN)  BID  19264
http://www.securityfocus.com/archive/1/archive/1/443185/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060814 Multiple Arbitrary Command Execution Vulnerabilities
http://www.securityfocus.com/archive/1/archive/1/443133/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060814 Informix - Discovery, Attack and Defense
http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
(UNKNOWN)  MISC  http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
http://www-1.ibm.com/support/docview.wss?uid=swg21242921
(UNKNOWN)  CONFIRM  http://www-1.ibm.com/support/docview.wss?uid=swg21242921
http://secunia.com/advisories/21301
(VENDOR_ADVISORY)  SECUNIA  21301
http://www.osvdb.org/27686
(UNKNOWN)  OSVDB  27686
http://securityreason.com/securityalert/1407
(UNKNOWN)  SREASON  1407

- 漏洞信息

Informix Dynamic Server SET DEBUG FILE SQL语句任意命令执行漏洞
高危 资料不足
2006-08-16 00:00:00 2006-09-19 00:00:00
远程※本地  
        Informix Dynamic Server(IDS)是一款由IBM开发的数据库
        攻击者可以向SET DEBUG FILE SQL语句和start_onpload及dbexp过程注入任意操作系统命令。注入到SET DEBUG FILE中的命令会以informix用户的权限执行;注入到dbexp或start_onpload中的命令会以登录用户的权限执行。
        

- 公告与补丁

        目前厂商已经发布了升级补丁以修复这个安全问题,补丁下载链接:
        http://support.novell.com/security-alerts

- 漏洞信息 (F49298)

NISR02082006F.txt (PacketStormID:F49298)
2006-08-27 00:00:00
David Litchfield  ngssoftware.com
advisory,arbitrary
CVE-2006-3860
[点击下载]

NGSSoftware Insight Security Research Advisory - Informix Dynamic Server is a database developed by IBM. During a security assessment of Informix multiple arbitrary command execution flaws were found. It is possible to inject arbitrary operating system commands into the SET DEBUG FILE SQL statement and the start_onpload and dbexp procedures. Any commands injected into SET DEBUG FILE will execute with the privileges of the informix user; any command injected into dbexp or start_onpload will execute with the privileges of the logged on user. All versions are affected.

NGSSoftware Insight Security Research Advisory

Name: Multiple Arbitrary Command Execution Vulnerabilities
Systems Affected: All versions of Informix
Severity: High
Vendor URL: http://www.ibm.com/
Author: David Litchfield [ davidl@ngssoftware.com ]
Date of Public Advisory: 2nd August 2006
Advisory number: #NISR02082006F
CVEID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3860
Advisory URL: http://www.ngssoftware.com/research/

Description
***********
Informix Dynamic Server is a database developed by IBM. During a security 
assessment of Informix multiple arbitrary command execution flaws were 
found.


Details
*******
It is possible to inject arbitrary operating system commands into the SET 
DEBUG FILE SQL statement and the start_onpload
 and dbexp procedures. Any commands injected into SET DEBUG FILE will 
execute with the privileges of the informix user; any command injected into 
dbexp or start_onpload will execute with the privileges of the logged on 
user.

Fix Information
***************
IBM was alerted to these flaws on the 6th January 2005. Patches have now 
been made available.

NGSSQuirreL for Informix, an advanced vulnerability assessment scanner 
designed specifically for Informix, can be used to accurately determine 
whether your servers are vulnerable to this flaw. More information about 
NGSSQuirreL for Informix can be found here 
http://www.ngssoftware.com/products/database-security/ngs-squirrel-informix.php

About NGSSoftware
*****************

NGSSoftware develops vulnerability assessment and compliancy tools for 
database servers including Oracle, Microsoft SQL Server, DB2, Sybase and 
Informix. Headquartered in the United Kingdom NGS has offices in London, St. 
Andrews (UK), Sydney, Brisbane, and Perth (Australia) and Texas in the 
United States; NGSConsulting provide services to some of the largest and 
most demanding organizations around the globe.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com


    

- 漏洞信息

27686
IBM Informix Dynamic Server SET DEBUG FILE Statement Arbitrary Command Execution
Location Unknown Input Manipulation
Loss of Integrity
Exploit Unknown

- 漏洞描述

Informix Dynamic Server contains an unspecified flaw related to the SET DEBUG FILE statement that may allow an attacker to execute arbitrary commands. No further details have been provided.

- 时间线

2006-07-31 2005-01-06
Unknow Unknow

- 解决方案

Upgrade to version 9.40.xC7, 10.00.xC3 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站