PT-2008-3488 · Ibm · Ibm Db2

Publicado 2008-04-27 · Atualizado 2018-10-11 · CVE-2008-1966

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 8.0 through 8.0 FP15 IBM DB2 versions 9.1 through 9.1 FP3 IBM DB2 versions 9.5 through 9.5 FP0

Description The issue is related to multiple buffer overflows in the JAR file administration routines within the BSU JAVA subcomponent. This can be exploited by remote authenticated users to cause a denial of service, specifically an instance crash, by calling certain procedures with crafted parameters. The affected procedures include RECOVERJAR and REMOVE JAR, and are related to sqlj.install jar and sqlj.replace jar.

Recommendations For IBM DB2 version 8, update to FP16 or later. For IBM DB2 version 9.1, update to FP4a or later. For IBM DB2 version 9.5, update to FP1 or later.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2008-1966

Produtos afetados

Ibm Db2

Referências · 13

• http://securityfocus.com/bid/28835 · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ08512 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41955 · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ15496 · Aviso do Fabricante
• http://osvdb.org/46269 · Nota
• http://securityfocus.com/bid/29601 · Nota
• http://securityfocus.com/archive/1/491071/100/0/threaded · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg21255607 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1966 · Nota de Segurança
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ08945 · Aviso do Fabricante
• http://secunia.com/advisories/29022 · Aviso do Fabricante
• http://osvdb.org/46268 · Nota
• http://appsecinc.com/resources/alerts/db2/2008-04.shtml · Nota