CVE-2006-3861
CVSS4.0
发布时间 :2006-08-08 18:04:00
修订时间 :2011-03-07 21:39:36
NMCOP    

[原文]IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 does not use database creation permissions, which allows remote authenticated users to create arbitrary databases.


[CNNVD]Informix Dynamic Server 获得连接权限漏洞(CNNVD-200608-098)

        Informix Dynamic Server(IDS)是一款由IBM开发的数据库。
        IBM Informix Dynamic Server中存在多个安全漏洞,具体如下:
        在Informix上公众(public)可以获得连接权限,因此任何登录用户都可以进行连接。公众还可以发布并创建数据库命令。在创建数据库时,创建该数据库的用户会成为该数据库的DBA。DBA可以以informix用户的权限执行代码,并逐步获得root用户权限。
        

- CVSS (基础分值)

CVSS分值: 4 [中等(MEDIUM)]
机密性影响: NONE [对系统的机密性无影响]
完整性影响: PARTIAL [可能会导致系统文件被修改]
可用性影响: NONE [对系统可用性无影响]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: NETWORK [攻击者不需要获取内网访问权或本地访问权]
身份认证: SINGLE_INSTANCE [--]

- CPE (受影响的平台与产品)

cpe:/a:ibm:informix_dynamic_server:10.0.xc1IBM Informix IDS 10.0.xC1
cpe:/a:ibm:informix_dynamic_server:9.40.xc5IBM Informix IDS 9.40.xC5
cpe:/a:ibm:informix_dynamic_server:9.40.tc5IBM Informix IDS 9.40.TC5
cpe:/a:ibm:informix_dynamic_server:9.40.uc1IBM Informix IDS 9.40.UC1
cpe:/a:ibm:informix_dynamic_server:9.40.uc2IBM Informix IDS 9.40.UC2
cpe:/a:ibm:informix_dynamic_server:7.31IBM Informix IDS 7.31
cpe:/a:ibm:informix_dynamic_server:9.40.uc3IBM Informix IDS 9.40.UC3
cpe:/a:ibm:informix_dynamic_server:9.4IBM Informix IDS 9.4
cpe:/a:ibm:informix_dynamic_server:9.40.uc5IBM Informix IDS 9.40.UC5
cpe:/a:ibm:informix_dynamic_server:10.0IBM Informix Dynamic Server 10.0

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3861
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2006-3861
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200608-098
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/xforce/xfdb/28148
(PATCH)  XF  informix-database-insecure-permission(28148)
http://www.securityfocus.com/bid/19264
(PATCH)  BID  19264
http://www-1.ibm.com/support/docview.wss?uid=swg21242921
(PATCH)  CONFIRM  http://www-1.ibm.com/support/docview.wss?uid=swg21242921
http://secunia.com/advisories/21301
(VENDOR_ADVISORY)  SECUNIA  21301
http://www.vupen.com/english/advisories/2006/3077
(UNKNOWN)  VUPEN  ADV-2006-3077
http://www.securityfocus.com/archive/1/archive/1/443192/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060814 Unauthorized Database Creation Privilege on Informix
http://www.securityfocus.com/archive/1/archive/1/443133/100/0/threaded
(UNKNOWN)  BUGTRAQ  20060814 Informix - Discovery, Attack and Defense
http://www.osvdb.org/27692
(UNKNOWN)  OSVDB  27692
http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
(UNKNOWN)  MISC  http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf

- 漏洞信息

Informix Dynamic Server 获得连接权限漏洞
中危 资料不足
2006-08-08 00:00:00 2007-01-05 00:00:00
远程※本地  
        Informix Dynamic Server(IDS)是一款由IBM开发的数据库。
        IBM Informix Dynamic Server中存在多个安全漏洞,具体如下:
        在Informix上公众(public)可以获得连接权限,因此任何登录用户都可以进行连接。公众还可以发布并创建数据库命令。在创建数据库时,创建该数据库的用户会成为该数据库的DBA。DBA可以以informix用户的权限执行代码,并逐步获得root用户权限。
        

- 公告与补丁

        目前厂商还没有提供补丁或者升级程序,建议使用此软件的用户随时关注厂商的主页以获取最新版本:
        http://support.novell.com/security-alerts

- 漏洞信息 (F49300)

NISR02082006H.txt (PacketStormID:F49300)
2006-08-27 00:00:00
David Litchfield  ngssoftware.com
advisory,root
CVE-2006-3861
[点击下载]

NGSSoftware Insight Security Research Advisory - Informix Dynamic Server is a database developed by IBM. During a security assessment of Informix it was discovered that any user can create a database and thus gain DBA privileges. On Informix public has the connect privilege; thus anyone with a login may connect. Public can also issue the create database command. When the database is created, the user that created the database is made a DBA of that database. A DBA can execute code as the informix user and trivially gain root privileges. Versions affected include 9.40.xC6 and earlier and 10.00.xC2, C1.

NGSSoftware Insight Security Research Advisory

Name: Unauthorized Database Creation Privilege on Informix
Systems Affected: 9.40.xC6 and earlier and 10.00.xC2, C1
Severity: High
Vendor URL: http://www.ibm.com/
Author: David Litchfield [ davidl@ngssoftware.com ]
Date of Public Advisory: 2nd August 2006
Advisory number: #NISR02082006H
CVEID: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3861
Advisory URL: http://www.ngssoftware.com/research/

Description
***********
Informix Dynamic Server is a database developed by IBM. During a security 
assessment of Informix it was discovered that any user can create a database 
and thus gain DBA privileges.

Details
*******
On Informix public has the connect privilege; thus anyone with a login may 
connect. Public can also issue the create database command. When the 
database is created, the user that created the database is made a DBA of 
that database. A DBA can execute code as the informix user and trivially 
gain root privileges.

Fix Information
***************
IBM was alerted to this flaw on the 13th January 2005. Patches have now been 
made available; further a workaround is to add "DBCREATE_PERMISSION 
username" to the ONCONFIG file where "username" is a list of comma seperated 
users that can create databases.

NGSSQuirreL for Informix, an advanced vulnerability assessment scanner 
designed specifically for Informix, can be used to accurately determine 
whether your servers are vulnerable to this flaw. More information about 
NGSSQuirreL for Informix can be found here 
http://www.ngssoftware.com/products/database-security/ngs-squirrel-informix.php

About NGSSoftware
*****************

NGSSoftware develops vulnerability assessment and compliancy tools for 
database servers including Oracle, Microsoft SQL Server, DB2, Sybase and 
Informix. Headquartered in the United Kingdom NGS has offices in London, St. 
Andrews (UK), Sydney, Brisbane, and Perth (Australia) and Texas in the 
United States; NGSConsulting provide services to some of the largest and 
most demanding organizations around the globe.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com


    

- 漏洞信息

27692
IBM Informix Dynamic Server Unauthorized Database Creation
Location Unknown Misconfiguration
Loss of Integrity
Exploit Unknown

- 漏洞描述

Informix Dynamic Server contains a flaw that may allow a malicious user to gain access to unauthorized privileges. The issue is triggered by default permissions that allow any authenticated user to create a database. This flaw may lead to a loss of integrity.

- 时间线

2006-07-31 2005-01-06
Unknow Unknow

- 解决方案

Upgrade to version 7.31.xD9, 9.40.xC8, 10.00.xC4 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

- 相关参考

- 漏洞作者

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站