Description
IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 does not use database creation permissions, which allows remote authenticated users to create arbitrary databases.
References
- 20060814 Unauthorized Database Creation Privilege on Informix mailing-list
- http://www-1.ibm.com/support/docview.wss?uid=swg21242921
- 20060814 Informix - Discovery, Attack and Defense mailing-list
- 27692 vdb-entry
- http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf
- informix-database-insecure-permission(28148) vdb-entry
- 21301 third-party-advisory
- 19264 vdb-entry
- ADV-2006-3077 vdb-entry