PT-2007-3901 · Ibm · Ibm Db2

Publicado 2007-05-09 · Atualizado 2018-10-16 · CVE-2007-2582

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.x and earlier

Description The issue concerns multiple buffer overflows in the DB2 JDBC Applet Server service. Remote attackers can execute arbitrary code by sending a crafted packet to the DB2JDS service on tcp/6789. Additionally, attackers can cause a denial of service through an invalid LANG parameter or by sending a long packet that results in a "MemTree overflow."

Recommendations For IBM DB2 versions 9.x and earlier, consider disabling the DB2JDS service on tcp/6789 until a patch is available. Restrict access to the DB2JDS service to minimize the risk of exploitation. Avoid using invalid LANG parameters in the DB2JDS service to prevent denial of service attacks. As a temporary workaround, limit the packet length to prevent "MemTree overflow" errors. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-2582

Produtos afetados

Ibm Db2

Referências · 13

• http://zerodayinitiative.com/advisories/ZDI-07-056.html · Nota
• http://securityfocus.com/archive/1/482024/100/0/threaded · Nota
• http://secunia.com/advisories/25148 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34184 · Nota
• http://www-1.ibm.com/support/search.wss?rs=0&q=IY97750&apar=only · Aviso do Fabricante
• http://securitytracker.com/id?1018801 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-2582 · Nota de Segurança
• http://securityfocus.com/bid/26010 · Nota
• http://securitytracker.com/id?1018029 · Nota
• http://osvdb.org/40975 · Nota
• http://vupen.com/english/advisories/2007/1707 · Aviso do Fabricante
• http://securityfocus.com/bid/23890 · Nota
• http://osvdb.org/40973 · Nota