The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
IBM Informix Dynamic Server SQLIDEBUG File Creation Vulnerability
------------------------------------------------------------------------
SUMMARY
IBM Corp.'s <http://www-306.ibm.com/software/data/informix/ids/> Informix
Dynamic Server is "an online transaction processing data server". Local
exploitation of a file creation vulnerability in IBM Corp.'s Informix
Dynamic Server allows attackers to elevate privileges to root.
DETAILS
Vulnerable Systems:
* IBM Corp.'s Informix Dynamic Server version 10.00 UC6TL installed on a
Linux
Immune Systems:
* IBM Corp.'s Informix Dynamic Server version 10.00.xC8
When the SQLIDEBUG environment variable is set, several set-uid binaries
will log debugging information to the specified file.
Analysis:
Exploitation allows local attackers to gain root privileges.
After creating the file, the file's ownership is changed to match the user
and group of the executing user. As such, an attacker could create files
that they own anywhere on the system.
Workaround:
Removing the set-uid bit from all programs included with Informix will
prevent exploitation. However, this could disable some functionality for
non-root users.
Vendor response:
IBM Corp. has addressed this vulnerability with the release of version
10.00.xC8 of Informix Dynamic Server. For more information, visit the
following URL <http://www-1.ibm.com/support/docview.wss?uid=swg27011556>
http://www-1.ibm.com/support/docview.wss?uid=swg27011556
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0369>
CVE-2008-0369
Disclosure Timeline:
09/01/2007 - Initial vendor notification
09/13/2007 - Initial vendor response
01/31/2008 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=650>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=650
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
