IBM DB2 Remote SQLJRA Packet Denial of Service Vulnerability

Bugtraq ID:	21646
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Dec 18 2006 12:00AM
Updated:	Dec 18 2006 08:28PM
Credit:	Vivek Rathod of Application Security, Inc. reported this issue.
Vulnerable:	IBM DB2 Universal Database Win98/NT/2000 7.0 IBM DB2 Universal Database for Windows NT 7.1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 IBM DB2 Universal Database for Windows NT 6.1 - Microsoft Windows 2000 Professional - Microsoft Windows NT 4.0 IBM DB2 Universal Database for Windows 8.12 IBM DB2 Universal Database for Windows 8.10 IBM DB2 Universal Database for Windows 8.2 IBM DB2 Universal Database for Windows 8.1.9 a IBM DB2 Universal Database for Windows 8.1.9 IBM DB2 Universal Database for Windows 8.1.8 a IBM DB2 Universal Database for Windows 8.1.8 IBM DB2 Universal Database for Windows 8.1.7 b IBM DB2 Universal Database for Windows 8.1.7 IBM DB2 Universal Database for Windows 8.1.6 c IBM DB2 Universal Database for Windows 8.1.6 IBM DB2 Universal Database for Windows 8.1.5 IBM DB2 Universal Database for Windows 8.1.4 IBM DB2 Universal Database for Windows 8.1 IBM DB2 Universal Database for Windows 8.0 IBM DB2 Universal Database for Windows 7.2 IBM DB2 Universal Database for Windows 7.1 IBM DB2 Universal Database for Windows 8.0 FixPak 13 IBM DB2 Universal Database for Solaris 8.12 IBM DB2 Universal Database for Solaris 8.10 IBM DB2 Universal Database for Solaris 8.2 IBM DB2 Universal Database for Solaris 8.1.9 a IBM DB2 Universal Database for Solaris 8.1.9 IBM DB2 Universal Database for Solaris 8.1.8 a IBM DB2 Universal Database for Solaris 8.1.8 IBM DB2 Universal Database for Solaris 8.1.7 b IBM DB2 Universal Database for Solaris 8.1.7 IBM DB2 Universal Database for Solaris 8.1.6 c IBM DB2 Universal Database for Solaris 8.1.6 IBM DB2 Universal Database for Solaris 8.1.5 IBM DB2 Universal Database for Solaris 8.1.4 IBM DB2 Universal Database for Solaris 8.1 IBM DB2 Universal Database for Solaris 8.0 IBM DB2 Universal Database for Solaris 7.2 IBM DB2 Universal Database for Solaris 7.1 IBM DB2 Universal Database for Solaris 7.0 IBM DB2 Universal Database for Solaris 6.1 IBM DB2 Universal Database for Solaris 6.0 IBM DB2 Universal Database for Solaris 8.0 FixPak 13 IBM DB2 Universal Database for OS/390 and z/OS 8.0 IBM DB2 Universal Database for OS/390 and z/OS 7.1 IBM DB2 Universal Database for OS/390 and z/OS 6.0 IBM DB2 Universal Database for OS/390 and z/OS 5.0 IBM DB2 Universal Database for OS/390 and z/OS 8.0 FixPak 13 IBM DB2 Universal Database for Linux 8.12 IBM DB2 Universal Database for Linux 8.10 IBM DB2 Universal Database for Linux 8.2 IBM DB2 Universal Database for Linux 8.1.9 a IBM DB2 Universal Database for Linux 8.1.9 IBM DB2 Universal Database for Linux 8.1.8 a IBM DB2 Universal Database for Linux 8.1.8 IBM DB2 Universal Database for Linux 8.1.7 b IBM DB2 Universal Database for Linux 8.1.7 IBM DB2 Universal Database for Linux 8.1.6 c IBM DB2 Universal Database for Linux 8.1.6 IBM DB2 Universal Database for Linux 8.1.5 IBM DB2 Universal Database for Linux 8.1.4 IBM DB2 Universal Database for Linux 8.1 IBM DB2 Universal Database for Linux 8.0 IBM DB2 Universal Database for Linux 7.2 IBM DB2 Universal Database for Linux 7.1 IBM DB2 Universal Database for Linux 7.0 IBM DB2 Universal Database for Linux 6.1 IBM DB2 Universal Database for Linux 6.0 IBM DB2 Universal Database for Linux 8.0 FixPak 13 IBM DB2 Universal Database for HP-UX 8.12 IBM DB2 Universal Database for HP-UX 8.10 IBM DB2 Universal Database for HP-UX 8.2 IBM DB2 Universal Database for HP-UX 8.1.9 a IBM DB2 Universal Database for HP-UX 8.1.9 IBM DB2 Universal Database for HP-UX 8.1.8 a IBM DB2 Universal Database for HP-UX 8.1.8 IBM DB2 Universal Database for HP-UX 8.1.7 b IBM DB2 Universal Database for HP-UX 8.1.7 IBM DB2 Universal Database for HP-UX 8.1.6 c IBM DB2 Universal Database for HP-UX 8.1.6 IBM DB2 Universal Database for HP-UX 8.1.5 IBM DB2 Universal Database for HP-UX 8.1.4 IBM DB2 Universal Database for HP-UX 8.1 IBM DB2 Universal Database for HP-UX 8.0 IBM DB2 Universal Database for HP-UX 7.2 IBM DB2 Universal Database for HP-UX 7.1 IBM DB2 Universal Database for HP-UX 7.0 IBM DB2 Universal Database for HP-UX 6.1 IBM DB2 Universal Database for HP-UX 6.0 IBM DB2 Universal Database for HP-UX 8.0 FixPak 13 IBM DB2 Universal Database for AIX 8.12 IBM DB2 Universal Database for AIX 8.10 IBM DB2 Universal Database for AIX 8.2 IBM DB2 Universal Database for AIX 8.1.9 a IBM DB2 Universal Database for AIX 8.1.9 IBM DB2 Universal Database for AIX 8.1.8 a IBM DB2 Universal Database for AIX 8.1.8 IBM DB2 Universal Database for AIX 8.1.7 b IBM DB2 Universal Database for AIX 8.1.7 IBM DB2 Universal Database for AIX 8.1.6 c IBM DB2 Universal Database for AIX 8.1.6 IBM DB2 Universal Database for AIX 8.1.5 IBM DB2 Universal Database for AIX 8.1.4 IBM DB2 Universal Database for AIX 8.1 IBM DB2 Universal Database for AIX 8.0 IBM DB2 Universal Database for AIX 7.2 IBM DB2 Universal Database for AIX 7.1 IBM DB2 Universal Database for AIX 7.0 IBM DB2 Universal Database for AIX 6.1 IBM DB2 Universal Database for AIX 6.0 IBM DB2 Universal Database for AIX 8.0 FixPak 13
Not Vulnerable:	IBM DB2 Universal Database for Windows 8.1 FixPak 14 IBM DB2 Universal Database for Solaris 8.1 FixPak 14 IBM DB2 Universal Database for OS/390 and z/OS 8.1 FixPak 14 IBM DB2 Universal Database for Linux 8.1 FixPak 14 IBM DB2 Universal Database for HP-UX 8.1 FixPak 14 IBM DB2 Universal Database for AIX 8.1 FixPak 14

IBM DB2 Remote SQLJRA Packet Denial of Service Vulnerability

DB2 Universal Database is affected by a remote denial-of-service vulnerability because the application fails to properly handle malformed packets in CONNECT data streams.

An attacker can exploit this vulnerability to cause a denial-of-service condition in affected database servers.

IBM DB2 Remote SQLJRA Packet Denial of Service Vulnerability

Currently we are not aware of any exploits for this issue. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected]:[email protected].

IBM DB2 Remote SQLJRA Packet Denial of Service Vulnerability

Solution:
The vendor has released Version 8.1 FixPak 14 (also called 8.2 FixPak 7) to address this issue; please see the reference section for more information.