IBM Informix Dynamic Server 11.50 SET COLLATION Stack OverFlow

[DCA-2011-0013]

[Discussion]
- DcLabs Security Research Group advises about the following vulnerability(ies):

[Software/Hardware]
- IBM Informix

[Vendor Product Description]
IBM Informix is a family of relational database management system
(RDBMS) developed by IBM.
It is positioned as IBM's flagship data server for online transaction
processing (OLTP) as well as integrated solutions. IBM acquired the
Informix technology in 2001.[1]
[1] Source: http://en.wikipedia.org/wiki/IBM_Informix

[Advisory Timeline]
Sent to vendor [10/21/2011]
Automatic Vendor Reply
Sent to vendor [09/06/2012]
Vendor reply [11/06/2012]
Sent to BugTrack after IBM disclosure without DcLabs credits [10/04/2012]

[Bug Summary]
The specific flaw exists within the oninit process bound to TCP port
9088 when processing the arguments to the COLLATION option in a SQL
query. User-supplied data is copied into a stack-based buffer without
proper bounds checking resulting in an overflow.

The vulnerability may/might result in possible arbitrary code execution under
the context of the database server

[Impact]
Medium

[Affected Version]
11.70
11.50
Previous Versions may also be vulnerable

[OS Platforms tested]
Windows XP SP3,
Windows 2003 R2
RedHat Enterprise 6,
Centos 5.3

[Evidences]
http://www.youtube.com/watch?v=3tjjHi6XC7I -  Informix 10.70
http://www.youtube.com/watch?v=eVm4bUio_Pc  - Informix 11.70

--
Ewerson Guimaraes (Crash)
Pentester/Researcher
DcLabs Security Team
www.dclabs.com.br