Potential for unauthorized access to the root account in the IBM
Informix I-Spy product.

**Flash (Alert)**
 
**Abstract**
Potential for unauthorized access to the root account in the IBM
Informix I-Spy product.
 
**Content**

*PROBLEM*

The runbin executable present in the $ISPY_DIR/bin directory has set
userid permission for user root. As a result, there is a potential for
user(s) to gain root access.

*SCOPE*

The following products and platforms are impacted :


*Products*
*Platforms*
*Names*
*Version*
*Hardware Vendors*
*Operating Systems*
IBM Informix I-Spy
# 2.00.UC4
# 2.00.UD1
# 2.00.FD1
# 2.00.UD2
# 2.00.FD2
All
All



*IMPACT*

Potential for unauthorized user(s) to gain root access.


*WORKAROUND *

Run the following script to remove the potential for unauthorized access.

      *Running the script *

      1. Save the script in the directory you want to run it from and
      rename it ispy_chg_privileges.sh.

                  </support/docview.wss?uid=swg21172742&aid=1> 2. Ensure that your I-Spy environment variables, ISPY_DIR and
      ISPY_CONFIGFILE, are set correctly. If you have not yet configured
      I-Spy and do not have a value for ISPY_CONFIGFILE, the script will
      do as much as it can without the information from that file, and
      you should consider running the script again after you configure
      I-Spy.
      3. Execute the script as root. You may use 'sh' or 'ksh' or 'bash'.

            # sh ./ispy_chg_privileges.sh 


*Note:*

          o The script removes the obsolete files isrunsql from
            $ISPY_DIR/bin and $ISPY_DIR/bin/realbin.
          o If you run installispy in the future, you will have to run
            this script again. 



*SOLUTION*

This problem has been identified as product issue 168233. The fix for
this product issue will be available in versions 2.00.UD3 and 2.00.FD3
scheduled to be released in August 2004. Contact Customer Services for
an upgrade to this version.


*WHO TO CONTACT*


*Service type*
*Contact*
Order a new release.
_Your local sales office_
<http://www.ibm.com/software/data/informix/howtobuy/>
Obtain more information, or
open a new case.
_Your local technical support office_
<http://www.ibm.com/software/data/informix/support/contact.html>

 

 

* Document information*

 Product categories:
  *Software*
  *Database & Data Management*
  *Database Tools & Utilities*
  *Informix Tools*
  *Informix I-SPY*
 Operating system(s):
  * Platform Independent *
 Software version:
  * 2.0x *
 Reference #:
  *1172742*
 IBM Group:
  *Software Group*
 Modified date:
  *2004-06-30*


 

This material provides me with the information I need.
Strongly Agree
Agree
Neutral
Disagree
Strongly Disagree

The language of this material is easy to understand.
Strongly Agree
Agree
Neutral
Disagree
Strongly Disagree

Please provide comments to help us improve this material
 
Your response will be used to improve our document content. Requests for
assistance should be submitted through your normal support channel as we
cannot respond from this site.