FKIE_CVE-2008-0727

Vulnerability from fkie_nvd - Published: 2008-03-18 00:44 - Updated: 2026-06-16 22:50
Severity
Summary
Multiple buffer overflows in oninit.exe in IBM Informix Dynamic Server (IDS) 7.x through 11.x allow (1) remote attackers to execute arbitrary code via a long password and (2) remote authenticated users to execute arbitrary code via a long DBPATH value.
References
cve@mitre.orghttp://secunia.com/advisories/29272Vendor Advisory
cve@mitre.orghttp://securityreason.com/securityalert/3749
cve@mitre.orghttp://www-1.ibm.com/support/docview.wss?uid=swg1IC55207
cve@mitre.orghttp://www-1.ibm.com/support/docview.wss?uid=swg1IC55208
cve@mitre.orghttp://www-1.ibm.com/support/docview.wss?uid=swg1IC55209
cve@mitre.orghttp://www-1.ibm.com/support/docview.wss?uid=swg1IC55210
cve@mitre.orghttp://www.securityfocus.com/archive/1/489547/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/archive/1/489548/100/0/threaded
cve@mitre.orghttp://www.securityfocus.com/bid/28198
cve@mitre.orghttp://www.vupen.com/english/advisories/2008/0860
cve@mitre.orghttp://www.zerodayinitiative.com/advisories/ZDI-08-011/
cve@mitre.orghttp://www.zerodayinitiative.com/advisories/ZDI-08-012/
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41202
cve@mitre.orghttps://exchange.xforce.ibmcloud.com/vulnerabilities/41203
af854a3a-2127-422b-91ae-364da2661108http://secunia.com/advisories/29272Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108http://securityreason.com/securityalert/3749
af854a3a-2127-422b-91ae-364da2661108http://www-1.ibm.com/support/docview.wss?uid=swg1IC55207
af854a3a-2127-422b-91ae-364da2661108http://www-1.ibm.com/support/docview.wss?uid=swg1IC55208
af854a3a-2127-422b-91ae-364da2661108http://www-1.ibm.com/support/docview.wss?uid=swg1IC55209
af854a3a-2127-422b-91ae-364da2661108http://www-1.ibm.com/support/docview.wss?uid=swg1IC55210
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/489547/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/archive/1/489548/100/0/threaded
af854a3a-2127-422b-91ae-364da2661108http://www.securityfocus.com/bid/28198
af854a3a-2127-422b-91ae-364da2661108http://www.vupen.com/english/advisories/2008/0860
af854a3a-2127-422b-91ae-364da2661108http://www.zerodayinitiative.com/advisories/ZDI-08-011/
af854a3a-2127-422b-91ae-364da2661108http://www.zerodayinitiative.com/advisories/ZDI-08-012/
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41202
af854a3a-2127-422b-91ae-364da2661108https://exchange.xforce.ibmcloud.com/vulnerabilities/41203
Impacted products
Vendor Product Version
ibm informix_dynamic_server 7.3
ibm informix_dynamic_server 7.31.xd8
ibm informix_dynamic_server 7.31.xd9
ibm informix_dynamic_server 9.3
ibm informix_dynamic_server 9.4
ibm informix_dynamic_server 9.40.tc5
ibm informix_dynamic_server 9.40.uc1
ibm informix_dynamic_server 9.40.uc2
ibm informix_dynamic_server 9.40.uc3
ibm informix_dynamic_server 9.40.uc5
ibm informix_dynamic_server 9.40.xd8
ibm informix_dynamic_server 9.40_xc7
ibm informix_dynamic_server 10.0
ibm informix_dynamic_server 10.0.xc3
ibm informix_dynamic_server 10.0.xc4
ibm informix_dynamic_server 10.00.xc7w1
ibm informix_dynamic_server 11.10.xc2
To clipboard 

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "n/a",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ],
      "source": "cve@mitre.org"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:7.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "9390D1EA-DB0A-40BB-BBA5-061DA17A2745",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:7.31.xd8:*:*:*:*:*:*:*",
              "matchCriteriaId": "14BA6483-76C0-4BE2-AE99-97B1AD555704",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:7.31.xd9:*:*:*:*:*:*:*",
              "matchCriteriaId": "E3D9652D-4383-40EE-950F-67794F4D52C6",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.3:*:*:*:*:*:*:*",
              "matchCriteriaId": "7A565470-B4A3-40FA-B691-1DB484FEC764",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.4:*:*:*:*:*:*:*",
              "matchCriteriaId": "58A9F81C-C618-435D-9912-0E61EAB02560",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.tc5:*:*:*:*:*:*:*",
              "matchCriteriaId": "CE9B0C17-2D85-4729-85EF-2F5C750BF51B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc1:*:*:*:*:*:*:*",
              "matchCriteriaId": "910D9A17-43A7-4F9E-98E0-2C465AC8BD2F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc2:*:*:*:*:*:*:*",
              "matchCriteriaId": "1E61711D-4C3E-4A6D-89A8-85B7CDD7FAE1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc3:*:*:*:*:*:*:*",
              "matchCriteriaId": "B2CD7B84-2861-4542-8A08-C668065C8DB4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc5:*:*:*:*:*:*:*",
              "matchCriteriaId": "E64D85E2-AA7E-4704-A2FA-BD69744423CF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.xd8:*:*:*:*:*:*:*",
              "matchCriteriaId": "EBFD2127-16EA-49F1-9023-F22A68F4EE3D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40_xc7:*:*:*:*:*:*:*",
              "matchCriteriaId": "3480BAB7-4D5B-44F2-8E8D-0062DD205D48",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:10.0:*:*:*:*:*:*:*",
              "matchCriteriaId": "1716E256-B186-442F-8C4C-9305E0953081",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:10.0.xc3:*:*:*:*:*:*:*",
              "matchCriteriaId": "C7931542-8DB8-4BC3-A319-9352EBC62158",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:10.0.xc4:*:*:*:*:*:*:*",
              "matchCriteriaId": "795E3755-48D3-4A70-9AFB-1B3B9F3B8F52",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:10.00.xc7w1:*:*:*:*:*:*:*",
              "matchCriteriaId": "1061A1A7-579D-4222-A31D-F34F8A11EA63",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:11.10.xc2:*:*:*:*:*:*:*",
              "matchCriteriaId": "539DE4E7-8531-43E8-AE75-178BFC4324F7",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Multiple buffer overflows in oninit.exe in IBM Informix Dynamic Server (IDS) 7.x through 11.x allow (1) remote attackers to execute arbitrary code via a long password and (2) remote authenticated users to execute arbitrary code via a long DBPATH value."
    },
    {
      "lang": "es",
      "value": "M\u00faltiples Desbordamientos de b\u00fafer en oninit.exe de IBM Informix Dynamic Server (IDS) de la versi\u00f3n 7.x a la 11.x, permite (1)a atacantes remotos ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una contrase\u00f1a larga (2) y usuarios autenticados remotamente, pueden ejecutar c\u00f3digo de su elecci\u00f3n a trav\u00e9s de una variable DBPATH larga."
    }
  ],
  "evaluatorComment": "All IBM links require software support sign in to view.",
  "id": "CVE-2008-0727",
  "lastModified": "2026-06-16T22:50:12.900",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "HIGH",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "COMPLETE",
          "baseScore": 8.5,
          "confidentialityImpact": "NONE",
          "integrityImpact": "COMPLETE",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:C/A:C",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 9.2,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ]
  },
  "published": "2008-03-18T00:44:00.000",
  "references": [
    {
      "source": "cve@mitre.org",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29272"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://securityreason.com/securityalert/3749"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC55207"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC55208"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC55209"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC55210"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/489547/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/archive/1/489548/100/0/threaded"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.securityfocus.com/bid/28198"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.vupen.com/english/advisories/2008/0860"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-08-011/"
    },
    {
      "source": "cve@mitre.org",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-08-012/"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41202"
    },
    {
      "source": "cve@mitre.org",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41203"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Vendor Advisory"
      ],
      "url": "http://secunia.com/advisories/29272"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://securityreason.com/securityalert/3749"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC55207"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC55208"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC55209"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC55210"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/489547/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/archive/1/489548/100/0/threaded"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.securityfocus.com/bid/28198"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.vupen.com/english/advisories/2008/0860"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-08-011/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "http://www.zerodayinitiative.com/advisories/ZDI-08-012/"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41202"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/41203"
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-119"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.


Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.