APP: IBM Informix Dynamic Server oninit.exe EXPLAIN Stack Buffer Overflow

This signature detects attempts to exploit a known stack buffer overflow in IBM Informix Dynamic Server Database. It is caused by insufficient checks within a logging function of the oninit.exe process. Remote authenticated attackers can exploit this by sending a crafted SET EXPLAIN command to the target server. A successful attack requires credentials to remotely connect to a vulnerable database server. An attacker can overflow the stack buffer allowing execution of arbitrary code with the privileges of the affected service. An unsuccessful attemp can result in a denial of service for the database.

Extended Description

IBM Informix is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Successfully exploiting this issue may allow an attacker to execute arbitrary code with SYSTEM-level privileges, completely compromising affected computers. Failed exploit attempts will result in a denial-of-service condition.

Affected Products

Ibm informix_ids

References

BugTraq: 44192

CVE: CVE-2010-4053

Short Name

APP:IBM:INFORMIX-EXPLAIN

Severity

Major

Recommended

False

Recommended Action

Drop

APP: IBM Informix Dynamic Server oninit.exe EXPLAIN Stack Buffer Overflow

Extended Description

Affected Products

References

Found a potential security threat?