home clear 64x64
en blue 200x116 de orange 200x116 info letter User
suche 36x36
Latest versionsfixlist
11.1.0.7 FixList
10.5.0.9 FixList
10.1.0.6 FixList
9.8.0.5 FixList
9.7.0.11 FixList
9.5.0.10 FixList
9.1.0.12 FixList
Have problems? - contact us.
Register for free anmeldung-x26
Contact form kontakt-x26

DB2 - Problem description

Problem IC84555 Status: Closed

SECURITY: STACK BUFFER OVERFLOW VULNERABILITY IN JAVA STORED PROCEDURE
INFRASTRUCTURE (CVE-2012-2197).

product:
DB2 FOR LUW / DB2FORLUW / 910 - DB2
Problem description:
A stack buffer overflow vulnerability in Java Stored Procedure 
infrastructure could be exploited to attain remote code 
execution. 
 
To exploit the vulnerability the malicious user would need: 
1) Valid credential to connect to database 
2) CONNECT privilege on database 
3) A Java stored procedure to which the user has EXECUTE 
privilege.
Problem Summary:
**************************************************************** 
* USERS AFFECTED:                                              * 
* All DB2 systems on all Linux, Unix and Windows platforms at  * 
* service levels from Version 9.1 GA through to Version 9.1    * 
* Fix Pack 11.                                                 * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* See Security Bulletin: Buffer Overflow Vulnerability in IBM  * 
* DB2 Java Stored Procedure Infrastructure (CVE-2012-2197).    * 
* http://www.ibm.com/support/docview.wss?uid=swg21607628       * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Upgrade to DB2 Version 9.1 Fix Pack 12.                      * 
****************************************************************
Local Fix:
Solution
The complete fix for this problem first appears in DB2 Version 
9.1 Fix Pack 12 and all the subsequent Fix Packs.
Workaround
not known / see Local fix
BUG-Tracking
forerunner  : APAR is sysrouted TO one or more of the following: IC84752 IC84753 IC84754 IC84755 
follow-up : 
Timestamps
Date  - problem reported    :
Date  - problem closed      :
Date  - last modified       :
14.06.2012
17.07.2012
21.08.2012
Problem solved at the following versions (IBM BugInfos)
9.1.FP12
Problem solved according to the fixlist(s) of the following version(s)
9.1.0.12 FixList