ZDI-08-011: IBM Informix Dynamic Server DBPATH Buffer Overflow
From: [email protected]
To: [email protected], [email protected]
Subject: ZDI-08-011: IBM Informix Dynamic Server DBPATH Buffer Overflow
Vulnerability
MIME-Version: 1.0
X-Mailer: Lotus Notes Release 7.0.2 December 03, 2006
Message-ID: <OF043B7A06.C8685B13-ON8825740B.00726CD7-8625740B.00732236@3com.com.>
Sender: [email protected]
Date: Thu, 13 Mar 2008 15:57:34 -0500
X-MIMETrack: Serialize by Router on USUT001/US/3Com(Release 6.5.5FP2|October 23, 2006) at
03/13/2008 01:57:38 PM,
Serialize complete at 03/13/2008 01:57:38 PM
Content-Type: text/plain;
charset="US-ASCII"
Content-Transfer-Encoding: base64
X-Virus-Scanned: antivirus-gw at tyumen.ru
WkRJLTA4LTAxMTogSUJNIEluZm9ybWl4IER5bmFtaWMgU2VydmVyIERCUEFUSCBCdWZmZXIgT3Zl
cmZsb3cgDQpWdWxuZXJhYmlsaXR5DQpodHRwOi8vd3d3Lnplcm9kYXlpbml0aWF0aXZlLmNvbS9h
ZHZpc29yaWVzL1pESS0wOC0wMTENCk1hcmNoIDEzLCAyMDA4DQoNCi0tIENWRSBJRDoNCkNWRS0y
MDA4LTA3MjcNCg0KLS0gQWZmZWN0ZWQgVmVuZG9yczoNCklCTQ0KDQotLSBBZmZlY3RlZCBQcm9k
dWN0czoNCklCTSBJbmZvcm1peA0KDQotLSBUaXBwaW5nUG9pbnQoVE0pIElQUyBDdXN0b21lciBQ
cm90ZWN0aW9uOg0KVGlwcGluZ1BvaW50IElQUyBjdXN0b21lcnMgaGF2ZSBiZWVuIHByb3RlY3Rl
ZCBhZ2FpbnN0IHRoaXMNCnZ1bG5lcmFiaWxpdHkgYnkgRGlnaXRhbCBWYWNjaW5lIHByb3RlY3Rp
b24gZmlsdGVyIElEIDU3MjMuIA0KRm9yIGZ1cnRoZXIgcHJvZHVjdCBpbmZvcm1hdGlvbiBvbiB0
aGUgVGlwcGluZ1BvaW50IElQUywgdmlzaXQ6DQoNCiAgICBodHRwOi8vd3d3LnRpcHBpbmdwb2lu
dC5jb20NCg0KLS0gVnVsbmVyYWJpbGl0eSBEZXRhaWxzOg0KVGhpcyB2dWxuZXJhYmlsaXR5IGFs
bG93cyByZW1vdGUgYXR0YWNrZXJzIHRvIGV4ZWN1dGUgYXJiaXRyYXJ5IGNvZGUgb24NCnN5c3Rl
bXMgd2l0aCB2dWxuZXJhYmxlIGluc3RhbGxhdGlvbnMgb2YgSUJNJ3MgSW5mb3JtaXggRHluYW1p
YyBTZXJ2ZXIuDQpVc2VyIGludGVyYWN0aW9uIGlzIG5vdCByZXF1aXJlZCB0byBleHBsb2l0IHRo
aXMgdnVsbmVyYWJpbGl0eS4NCkF1dGhlbnRpY2F0aW9uIGlzIHJlcXVpcmVkIGluIHRoYXQgYW4g
YXR0YWNrZXIgbXVzdCBoYXZlIGRhdGFiYXNlDQpjb25uZWN0aW9uIHByaXZpbGlnZXMuDQoNClRo
ZSBzcGVjaWZpYyBmbGF3IGV4aXN0cyBpbiB0aGUgb25pbml0LmV4ZSBwcm9jZXNzIHRoYXQgbGlz
dGVucyBieQ0KZGVmYXVsdCBvbiBUQ1AgcG9ydCAxNTI2LiBEdXJpbmcgYXV0aGVudGljYXRpb24s
IHRoZSBwcm9jZXNzIGRvZXMgbm90DQp2YWxpZGF0ZSB0aGUgbGVuZ3RoIG9mIHRoZSBEQlBBVEgg
dmFyaWFibGUuIEFuIGF0dGFja2VyIGNhbiBwcm92aWRlIGENCm92ZXJseSBsb25nIHZhcmlhYmxl
IG5hbWUgYW5kIG92ZXJmbG93IGEgZ2xvYmFsIGJ1ZmZlciwgb3ZlcndyaXRpbmcNCmZ1bmN0aW9u
IHBvaW50ZXJzIGxlYWRpbmcgdG8gYXJiaXRyYXJ5IGNvZGUgZXhlY3V0aW9uLg0KDQotLSBWZW5k
b3IgUmVzcG9uc2U6DQpJQk0gaGFzIGlzc3VlZCBhbiB1cGRhdGUgdG8gY29ycmVjdCB0aGlzIHZ1
bG5lcmFiaWxpdHkuIE1vcmUNCmRldGFpbHMgY2FuIGJlIGZvdW5kIGF0Og0KDQpodHRwOi8vd3d3
LTEuaWJtLmNvbS9zdXBwb3J0L2RvY3ZpZXcud3NzP3VpZD1zd2cxSUM1NTIwOA0KaHR0cDovL3d3
dy0xLmlibS5jb20vc3VwcG9ydC9kb2N2aWV3Lndzcz91aWQ9c3dnMUlDNTUyMDcNCg0KLS0gRGlz
Y2xvc3VyZSBUaW1lbGluZToNCjIwMDctMTEtMDcgLSBWdWxuZXJhYmlsaXR5IHJlcG9ydGVkIHRv
IHZlbmRvcg0KMjAwOC0wMy0xMyAtIENvb3JkaW5hdGVkIHB1YmxpYyByZWxlYXNlIG9mIGFkdmlz
b3J5DQoNCi0tIENyZWRpdDoNClRoaXMgdnVsbmVyYWJpbGl0eSB3YXMgZGlzY292ZXJlZCBieToN
CiAgICAqIEFub255bW91cw0KDQotLSBBYm91dCB0aGUgWmVybyBEYXkgSW5pdGlhdGl2ZSAoWkRJ
KToNCkVzdGFibGlzaGVkIGJ5IFRpcHBpbmdQb2ludCwgVGhlIFplcm8gRGF5IEluaXRpYXRpdmUg
KFpESSkgcmVwcmVzZW50cyANCmEgYmVzdC1vZi1icmVlZCBtb2RlbCBmb3IgcmV3YXJkaW5nIHNl
Y3VyaXR5IHJlc2VhcmNoZXJzIGZvciByZXNwb25zaWJseQ0KZGlzY2xvc2luZyBkaXNjb3ZlcmVk
IHZ1bG5lcmFiaWxpdGllcy4NCg0KUmVzZWFyY2hlcnMgaW50ZXJlc3RlZCBpbiBnZXR0aW5nIHBh
aWQgZm9yIHRoZWlyIHNlY3VyaXR5IHJlc2VhcmNoDQp0aHJvdWdoIHRoZSBaREkgY2FuIGZpbmQg
bW9yZSBpbmZvcm1hdGlvbiBhbmQgc2lnbi11cCBhdDoNCg0KICAgIGh0dHA6Ly93d3cuemVyb2Rh
eWluaXRpYXRpdmUuY29tDQoNClRoZSBaREkgaXMgdW5pcXVlIGluIGhvdyB0aGUgYWNxdWlyZWQg
dnVsbmVyYWJpbGl0eSBpbmZvcm1hdGlvbiBpcw0KdXNlZC4gVGlwcGluZ1BvaW50IGRvZXMgbm90
IHJlLXNlbGwgdGhlIHZ1bG5lcmFiaWxpdHkgZGV0YWlscyBvciBhbnkNCmV4cGxvaXQgY29kZS4g
SW5zdGVhZCwgdXBvbiBub3RpZnlpbmcgdGhlIGFmZmVjdGVkIHByb2R1Y3QgdmVuZG9yLA0KVGlw
cGluZ1BvaW50IHByb3ZpZGVzIGl0cyBjdXN0b21lcnMgd2l0aCB6ZXJvIGRheSBwcm90ZWN0aW9u
IHRocm91Z2gNCml0cyBpbnRydXNpb24gcHJldmVudGlvbiB0ZWNobm9sb2d5LiBFeHBsaWNpdCBk
ZXRhaWxzIHJlZ2FyZGluZyB0aGUNCnNwZWNpZmljcyBvZiB0aGUgdnVsbmVyYWJpbGl0eSBhcmUg
bm90IGV4cG9zZWQgdG8gYW55IHBhcnRpZXMgdW50aWwNCmFuIG9mZmljaWFsIHZlbmRvciBwYXRj
aCBpcyBwdWJsaWNseSBhdmFpbGFibGUuIEZ1cnRoZXJtb3JlLCB3aXRoIHRoZQ0KYWx0cnVpc3Rp
YyBhaW0gb2YgaGVscGluZyB0byBzZWN1cmUgYSBicm9hZGVyIHVzZXIgYmFzZSwgVGlwcGluZ1Bv
aW50DQpwcm92aWRlcyB0aGlzIHZ1bG5lcmFiaWxpdHkgaW5mb3JtYXRpb24gY29uZmlkZW50aWFs
bHkgdG8gc2VjdXJpdHkNCnZlbmRvcnMgKGluY2x1ZGluZyBjb21wZXRpdG9ycykgd2hvIGhhdmUg
YSB2dWxuZXJhYmlsaXR5IHByb3RlY3Rpb24gb3INCm1pdGlnYXRpb24gcHJvZHVjdC4NCg0KT3Vy
IHZ1bG5lcmFiaWxpdHkgZGlzY2xvc3VyZSBwb2xpY3kgaXMgYXZhaWxhYmxlIG9ubGluZSBhdDoN
Cg0KICAgIGh0dHA6Ly93d3cuemVyb2RheWluaXRpYXRpdmUuY29tL2Fkdmlzb3JpZXMvZGlzY2xv
c3VyZV9wb2xpY3kvDQoNCkNPTkZJREVOVElBTElUWSBOT1RJQ0U6IFRoaXMgZS1tYWlsIG1lc3Nh
Z2UsIGluY2x1ZGluZyBhbnkgYXR0YWNobWVudHMsDQppcyBiZWluZyBzZW50IGJ5IDNDb20gZm9y
IHRoZSBzb2xlIHVzZSBvZiB0aGUgaW50ZW5kZWQgcmVjaXBpZW50KHMpIGFuZA0KbWF5IGNvbnRh
aW4gY29uZmlkZW50aWFsLCBwcm9wcmlldGFyeSBhbmQvb3IgcHJpdmlsZWdlZCBpbmZvcm1hdGlv
bi4NCkFueSB1bmF1dGhvcml6ZWQgcmV2aWV3LCB1c2UsIGRpc2Nsb3N1cmUgYW5kL29yIGRpc3Ry
aWJ1dGlvbiBieSBhbnkgDQpyZWNpcGllbnQgaXMgcHJvaGliaXRlZC4gIElmIHlvdSBhcmUgbm90
IHRoZSBpbnRlbmRlZCByZWNpcGllbnQsIHBsZWFzZQ0KZGVsZXRlIGFuZC9vciBkZXN0cm95IGFs
bCBjb3BpZXMgb2YgdGhpcyBtZXNzYWdlIHJlZ2FyZGxlc3Mgb2YgZm9ybSBhbmQNCmFueSBpbmNs
dWRlZCBhdHRhY2htZW50cyBhbmQgbm90aWZ5IDNDb20gaW1tZWRpYXRlbHkgYnkgY29udGFjdGlu
ZyB0aGUNCnNlbmRlciB2aWEgcmVwbHkgZS1tYWlsIG9yIGZvcndhcmRpbmcgdG8gM0NvbSBhdCBw
b3N0bWFzdGVyQDNjb20uY29tLiANCg==
