CVE-2007-5956

Directory traversal vulnerability in IBM Informix Dynamic Server (IDS) before 10.00.xC7W1 allows local users to gain privileges by referencing modified NLS message files through directory traversal sequences in the DBLANG environment variable.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www-1.ibm.com/support/docview.wss?uid=swg27011082	Patch
http://www-1.ibm.com/support/docview.wss?uid=swg1IC54252
http://www.securityfocus.com/bid/26363
http://secunia.com/advisories/27542	Patch Vendor Advisory
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=624
http://www.vupen.com/english/advisories/2007/3757
https://exchange.xforce.ibmcloud.com/vulnerabilities/38297

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:informix_dynamic_server:*:*:*:*:*:*:*:*

Information

Published : 2007-11-14 03:46

Updated : 2017-07-28 18:33

NVD link : CVE-2007-5956

Mitre link : CVE-2007-5956

JSON object : View

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Advertisement

Products Affected

ibm

informix_dynamic_server

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www-1.ibm.com/support/docview.wss?uid=swg27011082", "name": "http://www-1.ibm.com/support/docview.wss?uid=swg27011082", "tags": ["Patch"], "refsource": "CONFIRM"}, {"url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC54252", "name": "IC54252", "tags": [], "refsource": "AIXAPAR"}, {"url": "http://www.securityfocus.com/bid/26363", "name": "26363", "tags": [], "refsource": "BID"}, {"url": "http://secunia.com/advisories/27542", "name": "27542", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=624", "name": "20071109 IBM Informix Dynamic Server DBLANG Directory Traversal Vulnerability", "tags": [], "refsource": "IDEFENSE"}, {"url": "http://www.vupen.com/english/advisories/2007/3757", "name": "ADV-2007-3757", "tags": [], "refsource": "VUPEN"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38297", "name": "ibm-ids-dblang-directory-traversal(38297)", "tags": [], "refsource": "XF"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Directory traversal vulnerability in IBM Informix Dynamic Server (IDS) before 10.00.xC7W1 allows local users to gain privileges by referencing modified NLS message files through directory traversal sequences in the DBLANG environment variable."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-22"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-5956", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "HIGH", "acInsufInfo": true, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2007-11-14T11:46Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:informix_dynamic_server:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndIncluding": "10.00"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2017-07-29T01:33Z"}