"Create Database" Security Hole?

Posted in 1999

Red Valsen — Fri, 30 Jul 1999 09:42:09 -0400 — source: Informix-list mailing list archive (1991-1998)

Is there any way to prevent a user (ANY user) from executing "create database <databasename>"? We're using IDS7.30.UC2 & 7.23.UC1/Solaris 2.6/x86, but I'm sure this is a ubiquitous capability (security hole?) on all Informix DB products.

↪ replying to Red Valsen

Art S. Kagel — Fri, 30 Jul 1999 12:41:24 -0400 — source: Informix-list mailing list archive (1991-1998)

Red Valsen wrote: > > Is there any way to prevent a user (ANY user) from executing "create > database <databasename>"? We're using IDS7.30.UC2 & 7.23.UC1/Solaris > 2.6/x86, but I'm sure this is a ubiquitous capability (security hole?) > on all Informix DB products. Only by denying the user access to the server by denying login privilege. Art S. Kagel

↪ replying to Red Valsen

Clifton M. Bean — Sat, 31 Jul 1999 17:28:49 -0500 — source: Informix-list mailing list archive (1991-1998)

There is a feature request or bug number (or both) assigned to this item; at least, I seem to remember this from my days in INFORMIX Technical Support. I just cannot remember the number assigned to it. Wonder if it will be part of the 9.2 product that is in beta testing at this time ... Red Valsen <red_valsen@yahoo.com> wrote in message news:37A1ABB1.A4367685@yahoo.com... > Is there any way to prevent a user (ANY user) from executing "create > database <databasename>"? We're using IDS7.30.UC2 & 7.23.UC1/Solaris > 2.6/x86, but I'm sure this is a ubiquitous capability (security hole?) > on all Informix DB products. >

↪ replying to Red Valsen

Chris Jenkins — Tue, 3 Aug 1999 14:28:09 +0100 — source: Informix-list mailing list archive (1991-1998)

Red, This is a recognised security issue. It is currently slated to be addressed in the next major release of IDS after 9.2 (IDS.2000). Chris Red Valsen wrote in message <37A1ABB1.A4367685@yahoo.com>... >Is there any way to prevent a user (ANY user) from executing "create >database <databasename>"? We're using IDS7.30.UC2 & 7.23.UC1/Solaris >2.6/x86, but I'm sure this is a ubiquitous capability (security hole?) >on all Informix DB products.