CVE-2017-1092 Code injection in Informix Servers
Unauthorized users can execute arbitrary code with system admin privileges on Windows servers using the IBM Informix Open Admin Tool.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2017-1092?
CVE-2017-1092 is a critical code injection vulnerability in IBM Corporation Informix Servers, published on 22 May 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
IBM Informix Open Admin Tool 11.5, 11.7, and 12.1 could allow an unauthorized user to execute arbitrary code as system admin on Windows servers. IBM X-Force ID: 120390.
Which versions are affected by CVE-2017-1092?
It affects 1 product.
Products include Ibm Informix Open Admin Tool.
How do I fix CVE-2017-1092?
No fix has been published for CVE-2017-1092 yet. Limit exposure of the affected software until one is available.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2017-1092 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-1092 exists.
Public exploit code: 1 Metasploit module and 2 Exploit-DB entries.
Other vulnerabilities in IBM Corporation Informix Servers
Sources
Also known as GHSA-rx9v-m99g-j38j.