bugtraq - [DCA-2011-0013] - IBM Informix Dynamic Server 11.50 SET COLLATION Stack OverFlow

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAN6_2VbouusrF52F6j+qyNZCuZyWaWdCPJfHaGK2m3id4t6dCw@mail.gmail.com>
Date: Thu, 4 Oct 2012 12:04:01 -0300
From: Ewerson Guimarães (Crash) - Dclabs <crash@...abs.com.br>
To: bugtraq@...urityfocus.com
Subject: [DCA-2011-0013] - IBM Informix Dynamic Server 11.50 SET COLLATION
 Stack OverFlow

IBM Informix Dynamic Server 11.50 SET COLLATION Stack OverFlow

[DCA-2011-0013]

[Discussion]
- DcLabs Security Research Group advises about the following vulnerability(ies):

[Software/Hardware]
- IBM Informix

[Vendor Product Description]
IBM Informix is a family of relational database management system
(RDBMS) developed by IBM.
It is positioned as IBM's flagship data server for online transaction
processing (OLTP) as well as integrated solutions. IBM acquired the
Informix technology in 2001.[1]
[1] Source: http://en.wikipedia.org/wiki/IBM_Informix

[Advisory Timeline]
Sent to vendor [10/21/2011]
Automatic Vendor Reply
Sent to vendor [09/06/2012]
Vendor reply [11/06/2012]
Sent to BugTrack after IBM disclosure without DcLabs credits [10/04/2012]

[Bug Summary]
The specific flaw exists within the oninit process bound to TCP port
9088 when processing the arguments to the COLLATION option in a SQL
query. User-supplied data is copied into a stack-based buffer without
proper bounds checking resulting in an overflow.

The vulnerability may/might result in possible arbitrary code execution under
the context of the database server

[Impact]
Medium

[Affected Version]
11.70
11.50
Previous Versions may also be vulnerable

[OS Platforms tested]
Windows XP SP3,
Windows 2003 R2
RedHat Enterprise 6,
Centos 5.3

[Evidences]
http://www.youtube.com/watch?v=3tjjHi6XC7I -  Informix 10.70
http://www.youtube.com/watch?v=eVm4bUio_Pc  - Informix 11.70

--
Ewerson Guimaraes (Crash)
Pentester/Researcher
DcLabs Security Team
www.dclabs.com.br