CVE-2006-3861

medium

Description

IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 does not use database creation permissions, which allows remote authenticated users to create arbitrary databases.

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/28148

http://www.vupen.com/english/advisories/2006/3077

http://www.securityfocus.com/bid/19264

http://www.securityfocus.com/archive/1/443192/100/0/threaded

http://www.securityfocus.com/archive/1/443133/100/0/threaded

http://www.osvdb.org/27692

http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf

http://www-1.ibm.com/support/docview.wss?uid=swg21242921

http://secunia.com/advisories/21301

Details

Source: Mitre, NVD

Published: 2006-08-08

Updated: 2024-11-21

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 6.5

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N