« Volver al listado

CVE-2006-3861

Estado: ModificadaMedia (4)—

IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 does not use database creation permissions, which allows remote authenticated users to create arbitrary databases.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

IBM — Informix Dynamic Server

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2006-3861",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2006-08-08T22:04:00.000",
  "references": [
    {
      "url": "http://secunia.com/advisories/21301",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21242921",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.osvdb.org/27692",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/443133/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/443192/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/19264",
      "tags": [
        "Patch"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/3077",
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28148",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://secunia.com/advisories/21301",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21242921",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.databasesecurity.com/informix/DatabaseHackersHandbook-AttackingInformix.pdf",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.osvdb.org/27692",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/443133/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/443192/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/19264",
      "tags": [
        "Patch"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2006/3077",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/28148",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-Other"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "IBM Informix Dynamic Server (IDS) before 9.40.xC7 and 10.00 before 10.00.xC3 does not use database creation permissions, which allows remote authenticated users to create arbitrary databases."
    },
    {
      "lang": "es",
      "value": "IBM Informix Dynamic Server (IDS) anterior a 9.40.xC7 y 10.00 anterior a 10.00.xC3 no utiliza permisos de creación de bases de datos, lo cual permite a usuarios autenticados remotamente crear bases de datos de su elección."
    }
  ],
  "lastModified": "2026-06-16T22:27:58.917",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:7.31:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "45A93A4B-8AB8-4BC7-9253-8DDA9D091C0A"
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.4:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "58A9F81C-C618-435D-9912-0E61EAB02560"
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.tc5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CE9B0C17-2D85-4729-85EF-2F5C750BF51B"
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "910D9A17-43A7-4F9E-98E0-2C465AC8BD2F"
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc2:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1E61711D-4C3E-4A6D-89A8-85B7CDD7FAE1"
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc3:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B2CD7B84-2861-4542-8A08-C668065C8DB4"
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.uc5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E64D85E2-AA7E-4704-A2FA-BD69744423CF"
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:9.40.xc5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "21FF7CE7-A061-425B-A29B-1EC6DEDA2C10"
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:10.0:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "1716E256-B186-442F-8C4C-9305E0953081"
            },
            {
              "criteria": "cpe:2.3:a:ibm:informix_dynamic_server:10.0.xc1:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "5634CF97-CBD3-4CA3-8144-2F875FDD3FA4"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org",
  "evaluatorSolution": "This vulnerability is addressed in the following product releases:\r\nIBM, Informix IDS, 9.40 xC7 \r\nIBM, Informix IDS, 10.00 xC3"
}