CVE-2008-0369: SQL Injection
Published Jan 18, 2008
·Updated
Multiple unspecified programs in IBM Informix Dynamic Server (IDS) 10.x before 10.00.xC8 allow local users to create arbitrary files by specifying the target file in the SQLIDEBUG environment variable, whose ownership is changed to the user invoking the programs.
Affected Software
1 affected component
IBM Informix Dynamic Server=10.00
Event History
Jan 18, 2008
CVE Published
via MITRE·11:00 PM
Data Sourced
via MITRE·11:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-0369?
CVE-2008-0369 has a low to medium severity rating due to its potential for local users to create arbitrary files.
2
How do I fix CVE-2008-0369?
To mitigate CVE-2008-0369, upgrade IBM Informix Dynamic Server to version 10.00.xC8 or later.
3
Who is affected by CVE-2008-0369?
Local users of IBM Informix Dynamic Server versions prior to 10.00.xC8 are affected by CVE-2008-0369.
4
What type of vulnerability is CVE-2008-0369?
CVE-2008-0369 is a local file creation vulnerability that can be exploited by local users.
5
What products are impacted by CVE-2008-0369?
CVE-2008-0369 specifically impacts IBM Informix Dynamic Server version 10.00.