PT-2004-2289 · Ibm · Ibm Db2

David Litchfield · Published 2004-09-01 · Updated 2017-07-11 · CVE-2004-1372

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions: IBM DB2 versions 7.x through 8.1

Description: The issue is related to multiple stack-based buffer overflows that allow local users to execute arbitrary code. This can be achieved by providing a long third argument to the rec2xml function or a long filename argument to the generate distfile procedure.

Recommendations: For IBM DB2 versions 7.x through 8.1, consider restricting access to the rec2xml function and the generate distfile procedure to minimize the risk of exploitation. Avoid using long arguments in these functions until a fix is available. At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Related Identifiers

CVE-2004-1372

Affected Products

Ibm Db2

References · 8

• http://securityfocus.com/bid/11089 · Patch
• http://ngssoftware.com/advisories/db223122004K.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2004-1372 · Security Note
• http://ngssoftware.com/advisories/db223122004L.txt · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18682 · Note
• http://marc.info/?l=bugtraq&m=110382730431065&w=2 · Note
• http://marc.info/?l=bugtraq&m=110382462924162&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18663 · Note