PT-2008-3488 · Ibm · Ibm Db2

Published 2008-04-27 · Updated 2018-10-11 · CVE-2008-1966

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 8.0 through 8.0 FP15 IBM DB2 versions 9.1 through 9.1 FP3 IBM DB2 versions 9.5 through 9.5 FP0

Description The issue is related to multiple buffer overflows in the JAR file administration routines within the BSU JAVA subcomponent. This can be exploited by remote authenticated users to cause a denial of service, specifically an instance crash, by calling certain procedures with crafted parameters. The affected procedures include RECOVERJAR and REMOVE JAR, and are related to sqlj.install jar and sqlj.replace jar.

Recommendations For IBM DB2 version 8, update to FP16 or later. For IBM DB2 version 9.1, update to FP4a or later. For IBM DB2 version 9.5, update to FP1 or later.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2008-1966

Affected Products

Ibm Db2

References · 13

• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ08512 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ15496 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1966 · Security Note
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ08945 · Vendor Advisory
• http://secunia.com/advisories/29022 · Vendor Advisory
• http://securityfocus.com/bid/28835 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41955 · Note
• http://osvdb.org/46269 · Note
• http://securityfocus.com/bid/29601 · Note
• http://securityfocus.com/archive/1/491071/100/0/threaded · Note
• http://www-1.ibm.com/support/docview.wss?uid=swg21255607 · Note
• http://osvdb.org/46268 · Note
• http://appsecinc.com/resources/alerts/db2/2008-04.shtml · Note