IBM DB2 Universal Database Server 'INSTALL_JAR' Arbitrary File Overwrite Vulnerability

Bugtraq ID:	35409
Class:	Unknown
CVE:	CVE-2008-2154
Remote:	Yes
Local:	No
Published:	Sep 08 2008 12:00AM
Updated:	Jun 17 2009 04:49PM
Credit:	An anonymous researcher working with the iDefense VCP
Vulnerable:	IBM DB2 Universal Database for Windows 8.2 IBM DB2 Universal Database for Windows 8.1.9 a IBM DB2 Universal Database for Windows 8.1.9 IBM DB2 Universal Database for Windows 8.1.8 a IBM DB2 Universal Database for Windows 8.1.8 IBM DB2 Universal Database for Windows 8.1.7 b IBM DB2 Universal Database for Windows 8.1.7 IBM DB2 Universal Database for Windows 8.1.6 c IBM DB2 Universal Database for Windows 8.1.6 IBM DB2 Universal Database for Windows 8.1.5 IBM DB2 Universal Database for Windows 8.1.4 IBM DB2 Universal Database for Windows 8.1 IBM DB2 Universal Database for Windows 8.0 IBM DB2 Universal Database for Windows 9.5 Fix Pak 1 IBM DB2 Universal Database for Windows 9.5 IBM DB2 Universal Database for Windows 9.1 FixPak 4 IBM DB2 Universal Database for Windows 9.1 FixPak 3 IBM DB2 Universal Database for Windows 9.1 FixPack 2 IBM DB2 Universal Database for Windows 9.1 IBM DB2 Universal Database for Windows 9.1 IBM DB2 Universal Database for Windows 9.0 Fix Pack 2 IBM DB2 Universal Database for Windows 8.2.0 Fixpak 16 IBM DB2 Universal Database for Windows 8.2 FixPak 7 IBM DB2 Universal Database for Windows 8.1 FixPak 15 IBM DB2 Universal Database for Windows 8.1 FixPak 14 IBM DB2 Universal Database for Windows 8.0 FixPak 16 IBM DB2 Universal Database for Windows 8.0 FixPak 13 IBM DB2 Universal Database for Solaris 9.0 IBM DB2 Universal Database for Solaris 8.2 IBM DB2 Universal Database for Solaris 8.1.9 a IBM DB2 Universal Database for Solaris 8.1.9 IBM DB2 Universal Database for Solaris 8.1.8 a IBM DB2 Universal Database for Solaris 8.1.8 IBM DB2 Universal Database for Solaris 8.1.7 b IBM DB2 Universal Database for Solaris 8.1.7 IBM DB2 Universal Database for Solaris 8.1.6 c IBM DB2 Universal Database for Solaris 8.1.6 IBM DB2 Universal Database for Solaris 8.1.5 IBM DB2 Universal Database for Solaris 8.1.4 IBM DB2 Universal Database for Solaris 8.1 IBM DB2 Universal Database for Solaris 8.0 IBM DB2 Universal Database for Solaris 9.5 FixPak 1 IBM DB2 Universal Database for Solaris 9.5 IBM DB2 Universal Database for Solaris 9.1 FixPak 4a IBM DB2 Universal Database for Solaris 9.1 Fixpak 4 IBM DB2 Universal Database for Solaris 9.1 FixPak 4 IBM DB2 Universal Database for Solaris 9.1 FixPak 3 IBM DB2 Universal Database for Solaris 9.1 FixPack 2 IBM DB2 Universal Database for Solaris 9.1 IBM DB2 Universal Database for Solaris 9.0.0 Fixpak 1 IBM DB2 Universal Database for Solaris 9.0 Fix Pack 2 IBM DB2 Universal Database for Solaris 8.2.0 Fixpak 16 IBM DB2 Universal Database for Solaris 8.2 FixPak 7 IBM DB2 Universal Database for Solaris 8.1 FixPak 15 IBM DB2 Universal Database for Solaris 8.1 FixPak 14 IBM DB2 Universal Database for Solaris 8.0 FixPak 16 IBM DB2 Universal Database for Solaris 8.0 FixPak 13 IBM DB2 Universal Database for Linux 9.0 IBM DB2 Universal Database for Linux 8.2 IBM DB2 Universal Database for Linux 8.1.9 a IBM DB2 Universal Database for Linux 8.1.9 IBM DB2 Universal Database for Linux 8.1.8 a IBM DB2 Universal Database for Linux 8.1.8 IBM DB2 Universal Database for Linux 8.1.7 b IBM DB2 Universal Database for Linux 8.1.7 IBM DB2 Universal Database for Linux 8.1.6 c IBM DB2 Universal Database for Linux 8.1.6 IBM DB2 Universal Database for Linux 8.1.5 IBM DB2 Universal Database for Linux 8.1.4 IBM DB2 Universal Database for Linux 8.1 IBM DB2 Universal Database for Linux 8.0 IBM DB2 Universal Database for Linux 9.5 FixPak 1 IBM DB2 Universal Database for Linux 9.5 IBM DB2 Universal Database for Linux 9.1 FixPak 4a IBM DB2 Universal Database for Linux 9.1 Fixpak 4 IBM DB2 Universal Database for Linux 9.1 FixPak 4 IBM DB2 Universal Database for Linux 9.1 FixPak 3 IBM DB2 Universal Database for Linux 9.1 FixPack 2 IBM DB2 Universal Database for Linux 9.1 IBM DB2 Universal Database for Linux 9.0.0 Fixpack 1 IBM DB2 Universal Database for Linux 9.0 Fix Pack 2 IBM DB2 Universal Database for Linux 8.2.0 Fixpak 16 IBM DB2 Universal Database for Linux 8.2 FixPak 7 IBM DB2 Universal Database for Linux 8.1 FixPak 15 IBM DB2 Universal Database for Linux 8.1 FixPak 14 IBM DB2 Universal Database for Linux 8.0 FixPak 16 IBM DB2 Universal Database for Linux 8.0 FixPak 13 IBM DB2 Universal Database for HP-UX 9.0 IBM DB2 Universal Database for HP-UX 8.2 IBM DB2 Universal Database for HP-UX 8.1.9 a IBM DB2 Universal Database for HP-UX 8.1.9 IBM DB2 Universal Database for HP-UX 8.1.8 a IBM DB2 Universal Database for HP-UX 8.1.8 IBM DB2 Universal Database for HP-UX 8.1.7 b IBM DB2 Universal Database for HP-UX 8.1.7 IBM DB2 Universal Database for HP-UX 8.1.6 c IBM DB2 Universal Database for HP-UX 8.1.6 IBM DB2 Universal Database for HP-UX 8.1.5 IBM DB2 Universal Database for HP-UX 8.1.4 IBM DB2 Universal Database for HP-UX 8.1 IBM DB2 Universal Database for HP-UX 8.0 IBM DB2 Universal Database for HP-UX 9.5 FixPak 1 IBM DB2 Universal Database for HP-UX 9.5 IBM DB2 Universal Database for HP-UX 9.1 FixPak 4a IBM DB2 Universal Database for HP-UX 9.1 Fixpak 4 IBM DB2 Universal Database for HP-UX 9.1 FixPak 3 IBM DB2 Universal Database for HP-UX 9.1 FixPack 2 IBM DB2 Universal Database for HP-UX 9.1 IBM DB2 Universal Database for HP-UX 9.1 IBM DB2 Universal Database for HP-UX 9.0.0 Fixpak 1 IBM DB2 Universal Database for HP-UX 9.0 Fix Pack 2 IBM DB2 Universal Database for HP-UX 8.2.0 Fixpak 16 IBM DB2 Universal Database for HP-UX 8.2 FixPak 7 IBM DB2 Universal Database for HP-UX 8.1 FixPak 15 IBM DB2 Universal Database for HP-UX 8.1 FixPak 14 IBM DB2 Universal Database for HP-UX 8.0 FixPak 16 IBM DB2 Universal Database for HP-UX 8.0 FixPak 13 IBM DB2 Universal Database for AIX 9.0 IBM DB2 Universal Database for AIX 8.12 IBM DB2 Universal Database for AIX 8.10 IBM DB2 Universal Database for AIX 8.2 IBM DB2 Universal Database for AIX 8.1.13 IBM DB2 Universal Database for AIX 8.1.9 a IBM DB2 Universal Database for AIX 8.1.9 IBM DB2 Universal Database for AIX 8.1.8 a IBM DB2 Universal Database for AIX 8.1.8 IBM DB2 Universal Database for AIX 8.1.7 b IBM DB2 Universal Database for AIX 8.1.7 IBM DB2 Universal Database for AIX 8.1.6 c IBM DB2 Universal Database for AIX 8.1.6 IBM DB2 Universal Database for AIX 8.1.5 IBM DB2 Universal Database for AIX 8.1.4 IBM DB2 Universal Database for AIX 8.1 IBM DB2 Universal Database for AIX 8.0 IBM DB2 Universal Database for AIX 9.5 FixPak 1 IBM DB2 Universal Database for AIX 9.5 IBM DB2 Universal Database for AIX 9.1 FixPak 4a IBM DB2 Universal Database for AIX 9.1 FixPak 4 IBM DB2 Universal Database for AIX 9.1 FixPak 3 IBM DB2 Universal Database for AIX 9.1 FixPack 2 IBM DB2 Universal Database for AIX 9.1 IBM DB2 Universal Database for AIX 9.1 IBM DB2 Universal Database for AIX 9.0.0 Fixpak 1 IBM DB2 Universal Database for AIX 9.0 Fix Pack 2 IBM DB2 Universal Database for AIX 8.2.0 Fixpak 16 IBM DB2 Universal Database for AIX 8.2 FixPak 7 IBM DB2 Universal Database for AIX 8.13 IBM DB2 Universal Database for AIX 8.1 FixPak 15 IBM DB2 Universal Database for AIX 8.1 FixPak 14 IBM DB2 Universal Database for AIX 8.0 FixPak 16 IBM DB2 Universal Database for AIX 8.0 FixPak 15 IBM DB2 Universal Database for AIX 8.0 FixPak 14 IBM DB2 Universal Database for AIX 8.0 FixPak 13 IBM DB2 Universal Database 9.5 Fix Pack 1 IBM DB2 Universal Database 9.5 IBM DB2 Universal Database 9.1 Fix Pack 4a IBM DB2 Universal Database 9.1 IBM DB2 Universal Database 8.1 FixPak 15 IBM DB2 Universal Database 8.1 IBM DB2 Universal Database 8.0.0 FixPak 17 IBM DB2 Universal Database 8.0.0 FixPak 16 IBM DB2 Universal Database 8.0
Not Vulnerable:	IBM DB2 Universal Database for Windows 8.2 Fixpak 17 IBM DB2 Universal Database for Windows 9.5 Fixpak 2 IBM DB2 Universal Database for Windows 9.1 Fixpak 5 IBM DB2 Universal Database for Solaris 8.2 Fixpak 17 IBM DB2 Universal Database for Solaris 9.5 Fixpak 2 IBM DB2 Universal Database for Solaris 9.1 Fixpak 5 IBM DB2 Universal Database for Linux 8.2 Fixpak 17 IBM DB2 Universal Database for Linux 9.5 Fixpak 2 IBM DB2 Universal Database for Linux 9.1 Fixpak 5 IBM DB2 Universal Database for HP-UX 8.2 Fixpak 17 IBM DB2 Universal Database for HP-UX 9.5 Fixpak 2 IBM DB2 Universal Database for HP-UX 9.1 Fixpak 5 IBM DB2 Universal Database for AIX 8.2 Fixpak 17 IBM DB2 Universal Database for AIX 9.5 Fixpak 2 IBM DB2 Universal Database for AIX 9.1 Fixpak 5 IBM DB2 Universal Database 9.5 Fixpak 2

IBM DB2 Universal Database Server 'INSTALL_JAR' Arbitrary File Overwrite Vulnerability

IBM DB2 Universal Database Server is prone to a vulnerability that could permit an attacker to overwrite arbitrary local files.

A remote, authenticated attacker can exploit this issue to create or overwrite arbitrary local files. This may lead to elevated privileges or a complete compromise of the vulnerable computer.

IBM DB2 Universal Database Server 'INSTALL_JAR' Arbitrary File Overwrite Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM DB2 Universal Database Server 'INSTALL_JAR' Arbitrary File Overwrite Vulnerability

Solution:
The vendor has released updates. Please see the references for details.

IBM DB2 Universal Database Server 'INSTALL_JAR' Arbitrary File Overwrite Vulnerability

References:

• IBM DB2 Homepage (IBM)
  
• Security Vulnerabilities and HIPER APARs fixed in DB2 for Linux, UNIX, and Windo (IBM)