|
|
| |
| A vulnerability allows remote attackers to execute arbitrary code on systems with vulnerable installations of IBM's Informix Dynamic Server. User interaction is not required to exploit this vulnerability. Authentication is not required to exploit this vulnerability. |
| |
Credit:
The information has been provided by The Zero Day Initiative (ZDI).
The original article can be found at: http://www.zerodayinitiative.com/advisories/ZDI-08-012
|
| |
Vulnerable Systems:
* IBM Informix Dynamic Server
The specific flaw exists in the oninit.exe process that listens by default on TCP port 1526. During authentication, the process does not validate the length of the supplied user password. An attacker can provide a overly long password and overflow a stack based buffer resulting in arbitrary code execution.
Vendor Response:
IBM has issued an update to correct this vulnerability. More details can be found at:
http://www-1.ibm.com/support/docview.wss?uid=swg1IC55210
http://www-1.ibm.com/support/docview.wss?uid=swg1IC55209
Disclosure Timeline:
2007-11-07 - Vulnerability reported to vendor
2008-03-13 - Coordinated public release of advisory
CVE Information:
CVE-2008-0727
|
|
|
|
|
|
|
|
