PT-2008-1517 · Ibm · Ibm Db2 Universal Database

Publicado 2008-04-16 · Atualizado 2017-07-29 · CVE-2007-5758

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 Universal Database versions 9.5 before Fix Pack 1 IBM DB2 Universal Database versions 9.1 before Fix Pack 4a IBM DB2 Universal Database versions 8 before FixPak 16

Description The issue is a stack-based buffer overflow in the db2dasrrm component of the DB2 Administration Server (DAS) that allows local users to execute arbitrary code via a long DASPROF environment variable, specifically the DASPROF variable.

Recommendations For IBM DB2 Universal Database version 9.5, apply Fix Pack 1 to resolve the issue. For IBM DB2 Universal Database version 9.1, apply Fix Pack 4a to resolve the issue. For IBM DB2 Universal Database version 8, apply FixPak 16 to resolve the issue.

Exploit

Correção

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2007-5758

Produtos afetados

Ibm Db2 Universal Database

Referências · 7

• 🔥 http://securityfocus.com/bid/27870 · Exploit
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41847 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5758 · Nota de Segurança
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=689 · Nota
• http://securitytracker.com/id?1019853 · Nota
• http://secunia.com/advisories/29784 · Aviso do Fabricante
• http://vupen.com/english/advisories/2008/1237/references · Nota