CVEvulnerability

CVE-2006-3857

6.5 MEDIUM Published 2006-08-08 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2006-08-08
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
6.5 MEDIUM — AV:N/AC:L/Au:S/C:P/I:P/A:P

Description

Multiple buffer overflows in IBM Informix Dynamic Server (IDS) before 9.40.TC6 and 10.00 before 10.00.TC3 allow remote authenticated users to execute arbitrary code via (1) the getname function, as used by (a) _sq_remview, (b) _sq_remproc, (c) _sq_remperms, (d) _sq_distfetch, and (e) _sq_dcatalog; and the (2) SET DEBUG FILE, (3) IFX_FILE_TO_FILE, (4) FILETOCLOB, (5) LOTOFILE, and (6) DBINFO functions (product defect IDs 171649, 171367, 171387, 171391, 171906, 172179).

Affected configurations

• ibm informix dynamic database server 9.3 • ibm informix dynamic database server 9.40.tc1 • ibm informix dynamic database server 9.40.tc2 • ibm informix dynamic database server 9.40.tc3 • ibm informix dynamic database server 9.40.tc4 • ibm informix dynamic database server 9.40.tc5 • ibm informix dynamic database server 9.40.uc1 • ibm informix dynamic database server 9.40.uc2 • ibm informix dynamic database server 9.40.uc3 • ibm informix dynamic database server 10.00.tc1 • ibm informix dynamic database server 10.00.tc2

References