Signature Detail

APP: IBM Informix Dynamic Server oninit.exe EXPLAIN Stack Buffer Overflow

This signature detects attempts to exploit a known stack buffer overflow in IBM Informix Dynamic Server Database. It is caused by insufficient checks within a logging function of the oninit.exe process. Remote authenticated attackers can exploit this by sending a crafted SET EXPLAIN command to the target server. A successful attack requires credentials to remotely connect to a vulnerable database server. An attacker can overflow the stack buffer allowing execution of arbitrary code with the privileges of the affected service. An unsuccessful attemp can result in a denial of service for the database.

Extended Description

IBM Informix is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue may allow an attacker to execute arbitrary code with SYSTEM-level privileges, completely compromising affected computers. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

• IBM Informix IDS 11.10
• IBM Informix IDS 11.10.Tb4tl
• IBM Informix IDS 11.10.TC3
• IBM Informix IDS 11.10.xC2
• IBM Informix IDS 11.10.xC2W2
• IBM Informix IDS 11.50
• IBM Informix IDS 11.50.xC1

References

• BugTraq: 44192
• CVE: CVE-2010-4053