CVE-2004-2489: Medium severity IBM Informix Dynamic Server vulnerability
Published Dec 31, 2004
·Updated
Format string vulnerability in IBM Informix Dynamic Server (IDS) before 9.40.xC3 allows local users to execute arbitrary code via a modified INFORMIXDIR environment variable that points to a file with format string specifiers in the filename.
Affected Software
2 affected components
IBM Informix Dynamic Server=9.40.uc1
IBM Informix Dynamic Server=9.40.uc2
Remediation
Patch Available
Patch Available
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
Oct 25, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2004-2489?
CVE-2004-2489 has a high severity level as it allows local users to execute arbitrary code.
2
How do I fix CVE-2004-2489?
To fix CVE-2004-2489, upgrade IBM Informix Dynamic Server to version 9.40.xC3 or later.
3
Who is affected by CVE-2004-2489?
CVE-2004-2489 affects local users of IBM Informix Dynamic Server versions 9.40.uc1 and 9.40.uc2.
4
What types of systems are vulnerable to CVE-2004-2489?
Systems running IBM Informix Dynamic Server prior to version 9.40.xC3 are vulnerable to CVE-2004-2489.
5
What is the nature of the vulnerability in CVE-2004-2489?
CVE-2004-2489 is a format string vulnerability that can be exploited through a modified INFORMIXDIR environment variable.