PT-2004-2289 · Ibm · Ibm Db2

David Litchfield · Publicado 2004-09-01 · Atualizado 2017-07-11 · CVE-2004-1372

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: IBM DB2 versions 7.x through 8.1

Description: The issue is related to multiple stack-based buffer overflows that allow local users to execute arbitrary code. This can be achieved by providing a long third argument to the rec2xml function or a long filename argument to the generate distfile procedure.

Recommendations: For IBM DB2 versions 7.x through 8.1, consider restricting access to the rec2xml function and the generate distfile procedure to minimize the risk of exploitation. Avoid using long arguments in these functions until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Correção

Identificadores relacionados

CVE-2004-1372

Produtos afetados

Ibm Db2

Referências · 8

• https://exchange.xforce.ibmcloud.com/vulnerabilities/18682 · Nota
• http://marc.info/?l=bugtraq&m=110382730431065&w=2 · Nota
• http://securityfocus.com/bid/11089 · Correção
• http://ngssoftware.com/advisories/db223122004K.txt · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2004-1372 · Nota de Segurança
• http://ngssoftware.com/advisories/db223122004L.txt · Aviso do Fabricante
• http://marc.info/?l=bugtraq&m=110382462924162&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18663 · Nota