CVE-2004-2489

Vulnerability

A format string vulnerability exists in IBM Informix Dynamic Server (IDS) versions before 9.40.xC3. The flaw occurs when the server processes the INFORMIXDIR environment variable. If a local user sets INFORMIXDIR to point to a directory containing a file whose filename includes format string specifiers (e.g., %s, %n), the server interprets these specifiers during error message construction or logging, leading to arbitrary code execution. Affected versions include 9.40.xC1 and 9.40.xC2 (tested on 9.40.UC1) [2].

Exploitation

An attacker must have local access to the system and the ability to set the INFORMIXDIR environment variable. The attacker creates a file with a name containing format string specifiers in a directory they control, then sets INFORMIXDIR to that directory. When Informix IDS processes the environment variable (e.g., during startup or when accessing configuration files), the format string is evaluated, potentially allowing the attacker to overwrite memory and execute arbitrary code. No authentication beyond local shell access is required [2].

Impact

Successful exploitation allows a local attacker to execute arbitrary code with the privileges of the Informix IDS process, which typically runs as a privileged user (e.g., informix). This can lead to full compromise of the database server and potentially the host system, including data theft, modification, or denial of service [2].

Mitigation

IBM released a fix in version 9.40.xC3. Users should upgrade to 9.40.xC3 or later. If upgrading is not immediately possible, restrict local access to trusted users only and monitor the INFORMIXDIR environment variable. No other workarounds are documented in the available references [2].