PT-2007-3901 · Ibm · Ibm Db2

Published 2007-05-09 · Updated 2018-10-16 · CVE-2007-2582

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.x and earlier

Description The issue concerns multiple buffer overflows in the DB2 JDBC Applet Server service. Remote attackers can execute arbitrary code by sending a crafted packet to the DB2JDS service on tcp/6789. Additionally, attackers can cause a denial of service through an invalid LANG parameter or by sending a long packet that results in a "MemTree overflow."

Recommendations For IBM DB2 versions 9.x and earlier, consider disabling the DB2JDS service on tcp/6789 until a patch is available. Restrict access to the DB2JDS service to minimize the risk of exploitation. Avoid using invalid LANG parameters in the DB2JDS service to prevent denial of service attacks. As a temporary workaround, limit the packet length to prevent "MemTree overflow" errors. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-2582

Affected Products

Ibm Db2

References · 13

• http://secunia.com/advisories/25148 · Vendor Advisory
• http://www-1.ibm.com/support/search.wss?rs=0&q=IY97750&apar=only · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-2582 · Security Note
• http://vupen.com/english/advisories/2007/1707 · Vendor Advisory
• http://zerodayinitiative.com/advisories/ZDI-07-056.html · Note
• http://securityfocus.com/archive/1/482024/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/34184 · Note
• http://securitytracker.com/id?1018801 · Note
• http://securityfocus.com/bid/26010 · Note
• http://securitytracker.com/id?1018029 · Note
• http://osvdb.org/40975 · Note
• http://securityfocus.com/bid/23890 · Note
• http://osvdb.org/40973 · Note