PT-2008-1517 · Ibm · Ibm Db2 Universal Database

Published 2008-04-16 · Updated 2017-07-29 · CVE-2007-5758

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Medium

Base vector

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 Universal Database versions 9.5 before Fix Pack 1 IBM DB2 Universal Database versions 9.1 before Fix Pack 4a IBM DB2 Universal Database versions 8 before FixPak 16

Description The issue is a stack-based buffer overflow in the db2dasrrm component of the DB2 Administration Server (DAS) that allows local users to execute arbitrary code via a long DASPROF environment variable, specifically the DASPROF variable.

Recommendations For IBM DB2 Universal Database version 9.5, apply Fix Pack 1 to resolve the issue. For IBM DB2 Universal Database version 9.1, apply Fix Pack 4a to resolve the issue. For IBM DB2 Universal Database version 8, apply FixPak 16 to resolve the issue.

Exploit

Fix

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2007-5758

Affected Products

Ibm Db2 Universal Database

References · 7

• 🔥 http://securityfocus.com/bid/27870 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-5758 · Security Note
• http://secunia.com/advisories/29784 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41847 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=689 · Note
• http://securitytracker.com/id?1019853 · Note
• http://vupen.com/english/advisories/2008/1237/references · Note