----------------------------------------------------------------------

To improve our services to our customers, we have made a number of
additions to the Secunia Advisories and have started translating the
advisories to German.

The improvements will help our customers to get a better
understanding of how we reached our conclusions, how it was rated,
our thoughts on exploitation, attack vectors, and scenarios.

This includes:
* Reason for rating
* Extended description
* Extended solution
* Exploit code or links to exploit code
* Deep links

Read the full description:
http://corporate.secunia.com/products/48/?r=l

Contact Secunia Sales for more information:
http://corporate.secunia.com/how_to_buy/15/?r=l

----------------------------------------------------------------------

TITLE:
IBM Informix Products Insecure Permissions and Temporary File
Creation

SECUNIA ADVISORY ID:
SA22609

VERIFY ADVISORY:
http://secunia.com/advisories/22609/

CRITICAL:
Less critical

IMPACT:
Privilege escalation

WHERE:
Local system

SOFTWARE:
IBM Informix Dynamic Server 10.x
http://secunia.com/product/11204/
IBM Informix Connect 2.x
http://secunia.com/product/12460/
IBM Informix Client Software Development Kit (CSDK) 2.x
http://secunia.com/product/12459/

DESCRIPTION:
Some vulnerabilities have been reported in various Informix Products,
which can be exploited by malicious, local users to perform certain
actions with escalated privileges.

1) Insecure file permissions of the installation scripts of the
applications can be exploited by unprivileged users to insert code,
which will be executed during installation.

2) An error exists due to temporary files being created insecurely in
"/tmp" during the installation process. This can be exploited via
symlink attacks to create or overwrite arbitrary files with
privileges of the user running the installation program.

The following products are affected:
* IBM Informix Dynamic Server version 10.00
* IBM Informix Client SDK version 2.90
* IBM Informix Connect version 2.90

SOLUTION:
Grant only trusted users access to affected systems and use the
"-log" option when performing the installation to create the
temporary files in a secure directory.

The vulnerabilities will reportedly be fixed in the following
versions:

-- IBM Informix Dynamic Server --
Solaris Opteron, Linux zSeries: Version 10.00.xC5R1
All others: Version 10.00.xC6

-- IBM Informix CSDK --
Solaris Opteron, Linux zSeries: Version 2.90.xC4R1
All others: Version 2.90.xC7

-- IBM Informix Connect --
Solaris Opteron, Linux zSeries: Version 2.90.xC4R1
All others: Version 2.90.xC7

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
http://www-1.ibm.com/support/docview.wss?uid=swg21247438

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------