IBM DB2 'REPEAT()' Heap Buffer Overflow Vulnerability

Bugtraq ID:	37976
Class:	Boundary Condition Error
CVE:	CVE-2010-0462
Remote:	No
Local:	Yes
Published:	Jan 27 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	Evgeny Legerov
Vulnerable:	IBM Tivoli Storage Manager 6.2.1 IBM Tivoli Storage Manager 6.2 IBM DB2 Universal Database 9.7.1 IBM DB2 Universal Database 9.7 IBM DB2 Universal Database 9.1 FP5 IBM DB2 Universal Database 9.1 Fix Pack 8 IBM DB2 Universal Database 9.1 Fix Pack 7 IBM DB2 Universal Database 9.1 Fix Pack 6a IBM DB2 Universal Database 9.1 Fix Pack 6 IBM DB2 Universal Database 9.1 Fix Pack 4a IBM DB2 Universal Database 9.1
Not Vulnerable:	IBM Tivoli Storage Manager 6.2.2 IBM DB2 Universal Database 9.1 Fix Pack 9

IBM DB2 'REPEAT()' Heap Buffer Overflow Vulnerability

IBM DB2 is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data.

Attackers can exploit this issue to execute arbitrary code with elevated privileges or crash the affected application.

The issue affects the following:

IBM DB2 versions prior to 9.1 Fix Pack 9
IBM DB2 9.7

Other versions may also be affected.

IBM DB2 'REPEAT()' Heap Buffer Overflow Vulnerability

The following proof-of-concept query is available:

SELECT REPEAT(REPEAT('1',1000),1073741825) FROM SYSIBM.SYSDUMMY1

IBM DB2 'REPEAT()' Heap Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references for more information.

IBM DB2 'REPEAT()' Heap Buffer Overflow Vulnerability

References:

• IBM DB2 9.7 heap overflow (Evgeny Legerov)
  
• IBM DB2 Homepage (IBM)
  
• IC65922: SECURITY: BUFFER OVERRUN IN REPEAT UDF. (IBM)
  
• IC69118: DB2 9.7 FIXPACK 2 REQUIRED FOR SECURITY FIXES (IBM)
  
• Security Vulnerabilities and HIPER APARs fixed in DB2 for Linux, UNIX, and Windo (IBM)