IBM DB2 Universal Database Prior to 9.1 Fixpak 5 Multiple Vulnerabilities

Bugtraq ID:	29601
Class:	Unknown
CVE:	CVE-2008-3853 CVE-2008-3854 CVE-2008-3855 CVE-2008-3856 CVE-2008-3857 CVE-2008-3858 CVE-2008-1966
Remote:	Yes
Local:	Yes
Published:	Jun 02 2008 12:00AM
Updated:	Jul 06 2016 02:17PM
Credit:	IBM, Martin Rakhmanov and Ariel Sanchez of Application Security Inc.
Vulnerable:	IBM DB2 Universal Database for Windows 9.1Fix Pak 4a IBM DB2 Universal Database for Windows 9.1 FixPak 4 IBM DB2 Universal Database for Windows 9.1 FixPak 3 IBM DB2 Universal Database for Windows 9.1 FixPack 2 IBM DB2 Universal Database for Windows 9.1 IBM DB2 Universal Database for Solaris 9.1 FixPak 4a IBM DB2 Universal Database for Solaris 9.1 FixPak 4 IBM DB2 Universal Database for Solaris 9.1 FixPak 3 IBM DB2 Universal Database for Solaris 9.1 FixPack 2 IBM DB2 Universal Database for Solaris 9.1 IBM DB2 Universal Database for Linux 9.1 FixPak 4a IBM DB2 Universal Database for Linux 9.1 FixPak 4 IBM DB2 Universal Database for Linux 9.1 FixPak 3 IBM DB2 Universal Database for Linux 9.1 FixPack 2 IBM DB2 Universal Database for Linux 9.1 IBM DB2 Universal Database for HP-UX 9.1 FixPak 4a IBM DB2 Universal Database for HP-UX 9.1 Fixpak 4 IBM DB2 Universal Database for HP-UX 9.1 FixPak 3 IBM DB2 Universal Database for HP-UX 9.1 FixPack 2 IBM DB2 Universal Database for HP-UX 9.1 IBM DB2 Universal Database for AIX 9.1 FixPak 4a IBM DB2 Universal Database for AIX 9.1 FixPak 4 IBM DB2 Universal Database for AIX 9.1 FixPak 3 IBM DB2 Universal Database for AIX 9.1 FixPack 2 IBM DB2 Universal Database for AIX 9.1
Not Vulnerable:	IBM DB2 Universal Database for Windows 9.1 Fixpak 5 IBM DB2 Universal Database for Solaris 9.1 Fixpak 5 IBM DB2 Universal Database for Linux 9.1 Fixpak 5 IBM DB2 Universal Database for HP-UX 9.1 Fixpak 5 IBM DB2 Universal Database for AIX 9.1 Fixpak 5

IBM DB2 Universal Database Prior to 9.1 Fixpak 5 Multiple Vulnerabilities

IBM DB2 Universal Database is prone to multiple vulnerabilities, including buffer-overflow issues, local privilege-escalation issues, and an unspecified issue.

An attacker may exploit these issues to execute arbitrary code, gain elevated privileges, or crash the affected application, denying service to legitimate users.

These vulnerabilities affect versions prior to DB2 9.1 Fixpak 5.

IBM DB2 Universal Database Prior to 9.1 Fixpak 5 Multiple Vulnerabilities

Currently we are not aware of any working exploits for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM DB2 Universal Database Prior to 9.1 Fixpak 5 Multiple Vulnerabilities

Solution:
IBM has released updates. Please see the references for more information.

IBM DB2 Universal Database Prior to 9.1 Fixpak 5 Multiple Vulnerabilities

References:

• DB2 Technical Support (IBM)
  
• IBM DB2 Universal Database Administration Server File Creation Vulnerability (iDefense Labs)
  
• Team SHATTER Security Advisory: IBM DB2 UDB - Buffer overrun in XMLQUERY and XM (Team SHATTER )
  
• Team SHATTER Security Advisory: Security Vulnerability in CLR stored procedure (Shatter )
  
• swg21255572 - DB2 Version 9.1 fix packs and clients (IBM)
  
• swg21255607 - DB2 Version 9.1 (IBM)