The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
IBM Informix Dynamic Server onedcu File Creation Vulnerability
------------------------------------------------------------------------
SUMMARY
IBM Corp.'s " <http://www-306.ibm.com/software/data/informix/ids/>
Informix Dynamic Server is an online transaction processing data server".
Local exploitation of a file creation vulnerability in IBM Corp.'s
Informix Dynamic Server allows attackers to elevate privileges to root.
DETAILS
Vulnerable Systems:
* IBM Corp.'s Informix Dynamic Server version 10.00 UC6TL installed on a
Linux system
Immune Systems:
* IBM Corp.'s Informix Dynamic Server version 10.00.xC8
The set-uid root "onedcu" command requires six parameters to be specified
when it is executed. The second parameter is a "Trace" file that this
program will open and write to with elevated privileges.
Analysis:
Exploitation allows local attackers to gain root privileges.
Workaround:
Removing the set-uid bit from the "onedcu" program included with Informix
will prevent exploitation. However, this could disable some functionality
for non-root users.
Vendor response:
IBM Corp. has addressed this vulnerability with the release of version
10.00.xC8 of Informix Dynamic Server. For more information, visit the
following URL <http://www-1.ibm.com/support/docview.wss?uid=swg27011556>
http://www-1.ibm.com/support/docview.wss?uid=swg27011556
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-0368>
CVE-2008-0368
Disclosure Timeline:
09/01/2007 - Initial vendor notification
09/13/2007 - Initial vendor response
01/31/2008 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=651>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=651
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
