IBM DB2 Semaphore Signaling Denial Of Service Vulnerability
BID:11403
Info
IBM DB2 Semaphore Signaling Denial Of Service Vulnerability
| Bugtraq ID: | 11403 |
| Class: | Access Validation Error |
| CVE: | |
| Remote: | No |
| Local: | Yes |
| Published: | Sep 01 2004 12:00AM |
| Updated: | Sep 01 2004 12:00AM |
| Credit: | Discovery is credited to Chris Anley of NGSSoftware. |
| Vulnerable: |
IBM DB2 Universal Database for Windows 8.1 IBM DB2 Universal Database for Windows 8.0 IBM DB2 Universal Database for Windows 7.2 IBM DB2 Universal Database for Windows 7.1 |
| Not Vulnerable: | |
Discussion
IBM DB2 Semaphore Signaling Denial Of Service Vulnerability
A denial of service vulnerability has been reported in IBM DB2. This vulnerability is reported to only exist when DB2 is installed on Microsoft Windows operating systems. This issue is due to a failure of the application to properly ensure that only authorized users can signal the DB2 UDB instance to shutdown. This is due to a Windows permissions issue related to shared memory sections, culminating in various denial of service attacks.
This vulnerability allows attackers with local access to shutdown the DB2 UDB instance. This will result in the denial of database service to legitimate users.
This issue was announced in BIDs 11089 and 11327. It is now being assigned its own BID since the vendor has provided additional technical information.
A denial of service vulnerability has been reported in IBM DB2. This vulnerability is reported to only exist when DB2 is installed on Microsoft Windows operating systems. This issue is due to a failure of the application to properly ensure that only authorized users can signal the DB2 UDB instance to shutdown. This is due to a Windows permissions issue related to shared memory sections, culminating in various denial of service attacks.
This vulnerability allows attackers with local access to shutdown the DB2 UDB instance. This will result in the denial of database service to legitimate users.
This issue was announced in BIDs 11089 and 11327. It is now being assigned its own BID since the vendor has provided additional technical information.
Exploit / POC
IBM DB2 Semaphore Signaling Denial Of Service Vulnerability
The following attacks were published:
- Users may set the 'DB2SHUTDOWNSEM' + pid event to shutdown the database. The following example was provided:
DB2SHUTDOWNSEM000002ec
- Non-zero values may be written to the 'DB2SHMSECURITYSERVICE' shared memory section and then read by setting the 'DB2NTSECURITYINPUT' input event.
- Users may write to the 'DB20QM' shared memory section. The following example was provided:
section write DB20QM
The following attacks were published:
- Users may set the 'DB2SHUTDOWNSEM' + pid event to shutdown the database. The following example was provided:
DB2SHUTDOWNSEM000002ec
- Non-zero values may be written to the 'DB2SHMSECURITYSERVICE' shared memory section and then read by setting the 'DB2NTSECURITYINPUT' input event.
- Users may write to the 'DB20QM' shared memory section. The following example was provided:
section write DB20QM
Solution / Fix
IBM DB2 Semaphore Signaling Denial Of Service Vulnerability
Solution:
The vendor has released FixPak 7a to address this issue:
IBM DB2 Universal Database for Windows 8.0
IBM DB2 Universal Database for Windows 8.1
Solution:
The vendor has released FixPak 7a to address this issue:
IBM DB2 Universal Database for Windows 8.0
IBM DB2 Universal Database for Windows 8.1
References
IBM DB2 Semaphore Signaling Denial Of Service Vulnerability
References:
References:
- APARs included in DB2 UDB Version 8 FixPak 6a and FixPak 7a (IBM)
- DB2 APAR IY62305 (IBM)
- DB2 V8 FixPaks 6 and 7 replaced with FixPaks 6a and 7a (IBM)
- IBM responds to DB2 UDB security vulnerability reports (IBM)
- IBM DB2 Windows Permission Problems (#NISR05012005F) ("NGSSoftware Insight Security Research"
- Patch available for critical IBM DB2 Universal Database flaws ("NGSSoftware Insight Security Research"
- Patch available for IBM DB2 Universal Database flaws ("NGSSoftware Insight Security Research"