|
|
|
|
| |
Credit:
The information has been provided by The Zero Day Initiative (ZDI).
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-08-011
|
| |
Vulnerable Systems:
* IBM Informix
The specific flaw exists in the oninit.exe process that listens by default on TCP port 1526. During authentication, the process does not validate the length of the DBPATH variable. An attacker can provide a overly long variable name and overflow a global buffer, overwriting function pointers leading to arbitrary code execution.
Vendor Response:
IBM has issued an update to correct this vulnerability. More details can be found at:
http://www-1.ibm.com/support/docview.wss?uid=swg1IC55208
http://www-1.ibm.com/support/docview.wss?uid=swg1IC55207
Disclosure Timeline:
2007-11-07 - Vulnerability reported to vendor
2008-03-13 - Coordinated public release of advisory
CVE Information:
CVE-2008-0727
|
|
|
|
|
