home clear 64x64
en blue 200x116 de orange 200x116 info letter User
suche 36x36
Latest versionsfixlist
11.1.0.7 FixList
10.5.0.9 FixList
10.1.0.6 FixList
9.8.0.5 FixList
9.7.0.11 FixList
9.5.0.10 FixList
9.1.0.12 FixList
Have problems? - contact us.
Register for free anmeldung-x26
Contact form kontakt-x26

DB2 - Problem description

Problem IC84716 Status: Closed

SECURITY: SQLJ.DB2_INSTALL_JAR DIRECTORY ESCAPE VULNERABILITY
(CVE-2012-2194).

product:
DB2 FOR LUW / DB2FORLUW / A10 - DB2
Problem description:
The stored procedure SQLJ.DB2_INSTALL_JAR contains a 
vulnerability which could be exploited to replace JAR files at 
the DB2 server.
Problem Summary:
**************************************************************** 
* USERS AFFECTED:                                              * 
* All DB2 systems on Windows platforms at service level        * 
* Version 10.1 GA.                                             * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* See Security Bulletin:  IBM DB2 Security Vulnerability in    * 
* SQLJ.DB2_INSTALL_JAR (CVE-2012-2194):                        * 
* http://www.ibm.com/support/docview.wss?uid=swg21607622       * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Upgrade to DB2 Version 10.1 or see "Local Fix"               * 
* portion for other suggestions.                               * 
****************************************************************
Local Fix:
Revoke EXECUTE privilege on SQLJ.DB2_INSTALL_JAR from PUBLIC.
available fix packs:
DB2 Version 10.1 Fix Pack 1 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 2 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 3 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 4 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 3a for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 6 for Linux, UNIX, and Windows

Solution
The complete fix for this problem first appears in DB2 Version 
10.1 and all the subsequent Fix Packs.
Workaround
not known / see Local fix
Timestamps
Date  - problem reported    :
Date  - problem closed      :
Date  - last modified       :
19.06.2012
24.09.2012
24.09.2012
Problem solved at the following versions (IBM BugInfos)
Problem solved according to the fixlist(s) of the following version(s)
10.1.0.1 FixList
10.5.0.1 FixList