what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

Informix-ids.txt

Informix-ids.txt
Posted Oct 4, 2006
Authored by Larry W. Cashdollar | Site vapid.dhs.org

IBM Informix (IDS) V10.0 suffers from several flaws that could allow an attacker to overwrite any file on the system or inject commands into the installer scripts.

tags | advisory
SHA-256 | e299b03aa62557f2b9a2a6bba84f0efdb77c22a8264d634d77e8361c2c039429

Informix-ids.txt

Change Mirror Download
IBM Informix (IDS) V10.0 File Clobbering during Install

10/1/2006
Overview
>From the Website (http://www-306.ibm.com/software/data/informix/ids/)

"IBM Informix(r) Dynamic Server (IDS) is a strategic data server in
the IBM Information Management Software portfolio that provides
blazing online transaction processing (OLTP) performance, legendary
reliability, and nearly hands-free administration to businesses of all
sizes. IDS 10 offers significant improvements in performance,
availability, security, and manageability over previous versions,
including patent-pending technology that virtually eliminates downtime
and automates many of the tasks associated with deploying
mission-critical enterprise systems."
Vulnerability

During installation the installserver script creates a file in /tmp
called installserver.txt an unpriviledged user can symlink this file
to another file causing the target file have the contents of
installserver.txt appened to it.

vapid:/tmp# ls -l /tmp/installserver.txt
lrwxrwxrwx 1 auditor auditor 11 Oct 1 18:27 /tmp/installserver.txt
-> /etc/passwd

After installation the contents of installserver.txt was appened to /etc/passwd.
File Permissions

The default file permissions of the installation package are too open,
an unpriviledged user can take advantage of an installation by a
priviledged user by injecting code into the installer script.

nobody@vapid:/home/auditor/test$ ls -l
total 273168
-rw-rw-rw- 1 root root 10328050 Aug 1 2005 Gls.rpm
-rw-rw-rw- 1 32100 1360 5125418 Aug 1 2005 IIF.jar
-rw-rw-rw- 1 root root 84374286 Aug 1 2005 IIFServer.rpm
-rw-rw-rw- 1 root root 786557 Aug 1 2005 Message.rpm
drwxrwxrwx 2 32100 1360 4096 Aug 1 2005 doc
-rw-r--r-- 1 auditor auditor 140032000 Oct 1 18:21
iif.10.00.UC3R1TL.Linux.tar
-rwxr-xr-x 1 32100 1360 4424 Aug 1 2005 install_rpm
-rwxrwxrwx 1 32100 1360 38727685 Oct 1 18:46 installserver
-rwxr-xr-x 1 32100 1360 5069 Aug 1 2005 server.ini

Resolution

The installer scripts should have more restrictive default
permissions, also the installserver.txt file should be moved inside of
the ismp001 directory that is created during installation.
Credit

Larry W. Cashdollar
http://vapid.dhs.org
Login or Register to add favorites

File Archive:

October 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    39 Files
  • 2
    Oct 2nd
    23 Files
  • 3
    Oct 3rd
    18 Files
  • 4
    Oct 4th
    0 Files
  • 5
    Oct 5th
    0 Files
  • 6
    Oct 6th
    0 Files
  • 7
    Oct 7th
    0 Files
  • 8
    Oct 8th
    0 Files
  • 9
    Oct 9th
    0 Files
  • 10
    Oct 10th
    0 Files
  • 11
    Oct 11th
    0 Files
  • 12
    Oct 12th
    0 Files
  • 13
    Oct 13th
    0 Files
  • 14
    Oct 14th
    0 Files
  • 15
    Oct 15th
    0 Files
  • 16
    Oct 16th
    0 Files
  • 17
    Oct 17th
    0 Files
  • 18
    Oct 18th
    0 Files
  • 19
    Oct 19th
    0 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2024 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close