SECURITY VULNERABILITIES IN IDS
A poster asked for details on two IDS security advisories: an ISM vulnerability tied to XDR functions (fixed in 10.00.xC8W1) and local file-creation/privilege-escalation flaws via SQLIDEBUG and onedcu (APARs IC54309, IC54307, fixed in 10.00.xC8), and whether IDS 7.x/9.x were affected. Jonathan Leffler answered: the XDR functions live in libnsl.so on Solaris (librpc or similar on Red Hat; check with ldd), and those OS bugs were patched years earlier. IDS 7.31 and 9.40 are affected but no longer get fix packs, so a patch port must be requested; ISM is re-released only on Windows. Back-porting the SQLIDEBUG fix to 7.31 is impractical, and a practical workaround for the onedcu issue is to remove or disable onperf, onedcu and onedpu.
Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.
1. http://www-1.ibm.com/support/docview.wss?rs=630&context=SSGU8G&context=SSHPYE&dc=D600&uid=swg21294211&loc=en_US&cs=utf-8&lang=en mentions an issue with ISM that allows gaining "administrator privileges" on the machine. Fixed in 10.00.xC8W1 due beginning of March. "Unix machines are not known to be affected unless the library provided by the operating system vendor containing the XDR functions is itself vulnerable." Which functions? What vulnerabillity? What is the library for Solaris 8, Redhat 3/4? Are IDS 7/9 affected? 2. http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=650 mentions "Local exploitation of a file creation vulnerability in IBM Corp.'s Informix Dynamic Server allows attackers to elevate privileges to root. When the SQLIDEBUG environment variable is set, several set-uid binaries will log debugging information to the specified file. " Following the fix list for 10.00.xC8 at http://www-1.ibm.com/support/docview.wss?uid=swg27011556 leads to two publically accessible APARs for security issues fixed in xC8: IC54309 SECURITY: SQLIDEBUG FILE CREATION VULNERABILITY IC54307 SECURITY: SERVER ONEDCU FILE CREATION VULNERABILITY Nothing says if IDS 7/9 are affected, are they affected?
david@smooth1.co.uk wrote: > 1. > http://www-1.ibm.com/support/docview.wss?rs=630&context=SSGU8G&context=SSHPYE&dc=D600&uid=swg21294211&loc=en_US&cs=utf-8&lang=en > > mentions an issue with ISM that allows gaining "administrator > privileges" on the machine. > > Fixed in 10.00.xC8W1 due beginning of March. > > "Unix machines are not known to be affected unless the library > provided by the operating system vendor containing the XDR functions > is itself vulnerable." Which functions? What vulnerability? What is > the library for Solaris 8, Redhat 3/4? xdr_* functions -- like it says. On Solaris (8, 9, 10), the library is libnsl.so For Redhat, it might be librpc; it might be something else altogether. You can poke around for a library containing functions that start 'xdr_' and that's most probably the one. You could use 'ldd' on the ISM executables to get candidate names, too. The relevant o/s bugs were fixed a number of years ago. XDR is a good search term in places like http://cve.mitre.org/. > Are IDS 7/9 affected? Yes, but neither 7.31 nor 9.40 gets regular fix packs any more, so you'll have to request a patch port. Note that ISM is in fact a separately versioned component of IDS. Also, you're not going to get a re-release of ISM unless you are on Windows - there's no need. > 2. http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=650 > > mentions > "Local exploitation of a file creation vulnerability in IBM Corp.'s > Informix Dynamic Server allows attackers to elevate privileges to > root. > > When the SQLIDEBUG environment variable is set, several set-uid > binaries will log debugging information to the specified file. " > > Following the fix list for 10.00.xC8 at http://www-1.ibm.com/support/docview.wss?uid=swg27011556 > leads to two publically accessible APARs for security issues fixed in > xC8: > > IC54309 SECURITY: SQLIDEBUG FILE CREATION VULNERABILITY > IC54307 SECURITY: SERVER ONEDCU FILE CREATION VULNERABILITY > > Nothing says if IDS 7/9 are affected, are they affected? As noted above, neither IDS 7.31 nor 9.40 gets regular fix packs any more. The code changes were checked into 9.40 and dragged forward. Back-porting the SQLIDEBUG fix to IDS 7.31 would be hard because the fix included a major overhaul of the SQLIDEBUG code; the ONEDCU fix is pretty straight-forward to back-port. (Unless you actively use ON-Perf, a better workaround for the ONEDCU problem is to remove or disable onperf, onedcu and onedpu.) -- Jonathan Leffler #include <disclaimer.h> Email: jleffler@earthlink.net, jleffler@us.ibm.com Guardian of DBD::Informix v2007.0914 -- http://dbi.perl.org/ publictimestamp.org/ptb/PTB-2550 sha256 2008-02-18 06:00:06 584876CDEE4ED8A07EEA0CB5B761FFE73729DA383218C7E1DA3B2BB4D8A7F97B