VulnerabilityModified
CVE-2006-3862
Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC5 through 9.40.xC7 and 10.00.TC1 through 10.00.xC3 allows attackers to execute arbitrary code via the SQLIDEBUG environment variable (envariable).
HIGH 7.5EPSS 3.65%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (3.65%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Buffer overflow in IBM Informix Dynamic Server (IDS) 9.40.TC5 through 9.40.xC7 and 10.00.TC1 through 10.00.xC3 allows attackers to execute arbitrary code via the SQLIDEBUG environment variable (envariable).
- CVSS 2.0
- 7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P
- EPSS
- 3.65% probability · 89th percentile
- CISA KEV
- Not listed
- Affected
- ibm/informix dynamic server
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/21301
- http://www-1.ibm.com/support/docview.wss?uid=swg21242921Patch
- http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
- http://www.osvdb.org/27694
- http://www.securityfocus.com/archive/1/443133/100/0/threaded
- http://www.securityfocus.com/archive/1/443165/100/0/threaded
- http://www.securityfocus.com/bid/19264
- http://www.vupen.com/english/advisories/2006/3077
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28158
- http://secunia.com/advisories/21301
- http://www-1.ibm.com/support/docview.wss?uid=swg21242921Patch
- http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
- http://www.osvdb.org/27694
- http://www.securityfocus.com/archive/1/443133/100/0/threaded
- http://www.securityfocus.com/archive/1/443165/100/0/threaded
- http://www.securityfocus.com/bid/19264
- http://www.vupen.com/english/advisories/2006/3077
- https://exchange.xforce.ibmcloud.com/vulnerabilities/28158
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.