CVE-2006-3858: Low severity IBM Informix Dynamic Server vulnerability
Published Aug 8, 2006
·Updated
IBM Informix Dynamic Server (IDS) before 9.40.xC8 and 10.00 before 10.00.xC4 stores passwords in plaintext in shared memory, which allows local users to obtain passwords by reading the memory (product defects 171893, 171894, 173772).
Affected Software
11 affected components
IBM Informix Dynamic Server=9.40.uc3
IBM Informix Dynamic Server=9.40.uc2
IBM Informix Dynamic Server=9.40.xc7
IBM Informix Dynamic Server=9.40.tc5
IBM Informix Dynamic Server=9.40.xc5
IBM Informix Dynamic Server=9.40.uc1
IBM Informix Dynamic Server=10.0.xc1
IBM Informix Dynamic Server=10.0.xc3
IBM Informix Dynamic Server=10.0
IBM Informix Dynamic Server=9.4
IBM Informix Dynamic Server=9.40.uc5
Remediation
Patch Available
Patch Available
Patch Available
Event History
Aug 8, 2006
CVE Published
10:04 PM
Aug 9, 2006
CVE Published
via MITRE·02:00 AM
Data Sourced
via MITRE·02:00 AM
Description
Frequently Asked Questions
1
What is the severity of CVE-2006-3858?
CVE-2006-3858 is considered a high severity vulnerability due to the storage of passwords in plaintext.
2
How do I fix CVE-2006-3858?
To fix CVE-2006-3858, upgrade to IBM Informix Dynamic Server version 9.40.xC8 or 10.00.xC4 or newer.
3
What are the implications of CVE-2006-3858?
CVE-2006-3858 allows local users to read passwords from shared memory, posing a significant security risk.
4
Which versions of IBM Informix Dynamic Server are affected by CVE-2006-3858?
CVE-2006-3858 affects IBM Informix Dynamic Server versions before 9.40.xC8 and 10.00 before 10.00.xC4.
5
Can local users exploit CVE-2006-3858?
Yes, local users can exploit CVE-2006-3858 by accessing shared memory to obtain plaintext passwords.