|
Problem IC62625
|
Status: Geschlossen |
SECURITY: Remote exploits of DB2 provided routines. |
| Produkt: |
DB2 FOR LUW / DB2FORLUW / 950 - DB2 |
| Problembeschreibung: |
Remote exploitation of buffer overrun in DB2 provided table
functions could allow an attacker to elevate privileges to that
of the db2fmp process or cause the db2fmp process to trap.
Trapping of the db2fmp process will not cause the DB2 server
outages but will cause those FENCED, THREADSAFE routines also
running in the db2fmp process to terminate.
The remote exploitation will require the attacker to pass DB2
authentication.
This problem was reported to IBM by an anonymous researcher
working with TippingPoint's Zero Day Initiative
(http://www.zerodayinitiative.com) |
| Problem-Zusammenfassung: |
****************************************************************
* USERS AFFECTED: *
* All DB2 systems on all Linux, Unix and Windows platforms at *
* service levels from Version 9.5 GA through to Version 9.5 *
* Fix Pack 4. *
****************************************************************
* PROBLEM DESCRIPTION: *
* See Error Description. *
****************************************************************
* RECOMMENDATION: *
* Upgrade to DB2 Version 9.5 Fix Pack 5 or see "Local Fix" *
* portion for other suggestions. *
**************************************************************** |
| Local-Fix: |
There is no workaround however revoking CONNECT privilege from
PUBLIC will reduce the exposure. |
| verfügbare FixPacks: |
DB2 Version 9.5 Fix Pack 5 for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 6a for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 7 for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 8 for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 9 for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 10 for Linux, UNIX, and Windows
|
| Lösung |
The complete fix for this problem first appears in DB2 Version
9.5 Fix Pack 5 and all the subsequent Fix Packs. |
| Workaround |
keiner bekannt / siehe Local-Fix |
| Weitere Daten |
Datum - Problem gemeldet :
Datum - Problem geschlossen :
Datum - der letzten Änderung:
| 18.08.2009
15.12.2009
15.12.2009 |
| Problem behoben ab folgender Versionen (IBM BugInfos) |
9.5.FP5
|
| Problem behoben lt. FixList in der Version |
| 9.5.0.5
|
 |
