CVE-2004-2131

Description

Stack-based buffer overflow in ontape for IBM Informix Dynamic Server (IDS) 9.40.xC3 and earlier allows local users, with DSA privileges, to execute arbitrary code via a long ONCONFIG environment variable.

Affected products

• ibm / informix_dynamic_server9.40.uc1 – 9.40.uc1
• ibm / informix_dynamic_server9.40.uc2 – 9.40.uc2
• ibm / informix_extended_parallel_server8.40_uc1 – 8.40_uc1

Exploits & proofs of concept

• exploit-dbIBM Informix Dynamic Server 9.40/Informix Extended Parallel Server 8.40 - Multiple Vulnerabilities (2)by pask
• exploit-dbIBM Informix Dynamic Server 9.40/Informix Extended Parallel Server 8.40 - Multiple Vulnerabilities (1)by pask

References

• MISChttp://www.osvdb.org/3759
• MISChttp://www.securityfocus.com/bid/9512
• MISChttps://exchange.xforce.ibmcloud.com/vulnerabilities/14970
• VENDOR_ADVISORYhttp://secunia.com/advisories/10737/
• MAILING_LISThttp://marc.info/?l=bugtraq&m=107539878804074&w=2
• MISChttp://www-1.ibm.com/support/docview.wss?uid=swg21153336