CVE-2007-5956

Directory traversal vulnerability in IBM Informix Dynamic Server (IDS) before 10.00.xC7W1 allows local users to gain privileges by referencing modified NLS message files through directory traversal sequences in the DBLANG environment variable.

CVSS v2.0 7.2 HIGH

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=624
http://secunia.com/advisories/27542	Patch Vendor Advisory
http://www-1.ibm.com/support/docview.wss?uid=swg1IC54252
http://www-1.ibm.com/support/docview.wss?uid=swg27011082	Patch
http://www.securityfocus.com/bid/26363
http://www.vupen.com/english/advisories/2007/3757
https://exchange.xforce.ibmcloud.com/vulnerabilities/38297

Configurations

Configuration 1 (hide)

cpe:2.3:a:ibm:informix_dynamic_server:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-11-14 11:46

Updated : 2023-12-10 10:40

NVD link : CVE-2007-5956

Mitre link : CVE-2007-5956

CVE.ORG link : CVE-2007-5956

JSON object : View

Products Affected

ibm

informix_dynamic_server

CWE

CWE-22

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

{"id": "CVE-2007-5956", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": true, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2007-11-14T11:46:00.000", "references": [{"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=624", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/27542", "tags": ["Patch", "Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IC54252", "source": "cve@mitre.org"}, {"url": "http://www-1.ibm.com/support/docview.wss?uid=swg27011082", "tags": ["Patch"], "source": "cve@mitre.org"}, {"url": "http://www.securityfocus.com/bid/26363", "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2007/3757", "source": "cve@mitre.org"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/38297", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-22"}]}], "descriptions": [{"lang": "en", "value": "Directory traversal vulnerability in IBM Informix Dynamic Server (IDS) before 10.00.xC7W1 allows local users to gain privileges by referencing modified NLS message files through directory traversal sequences in the DBLANG environment variable."}, {"lang": "es", "value": "Una vulnerabilidad de salto de directorio en IBM Informix Dynamic Server (IDS) versiones anteriores a 10.00.xC7W1, permite a usuarios locales alcanzar privilegios haciendo referencia a archivos de mensajes NLS modificados por medio de secuencias de salto de directorio en la variable de entorno DBLANG."}], "lastModified": "2017-07-29T01:33:57.117", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:informix_dynamic_server:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D20BA745-CBA6-4429-BF60-14ED23F7591E", "versionEndIncluding": "10.00"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}