IBM DB2 Administration Server (DAS) Buffer Overflow Vulnerability

Bugtraq ID:	46052
Class:	Boundary Condition Error
CVE:	CVE-2011-0731
Remote:	Yes
Local:	No
Published:	Jan 27 2011 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	Anonymous researcher from the Zero Day Initiative
Vulnerable:
Not Vulnerable:

IBM DB2 Administration Server (DAS) Buffer Overflow Vulnerability

IBM DB2 is prone to a buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

The following versions of DB2 are vulnerable:

DB2 9.1 prior to Fix Pack 10
DB2 9.5 prior to Fix Pack 7
DB2 9.7 prior to Fix Pack 3

IBM DB2 Administration Server (DAS) Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM DB2 Administration Server (DAS) Buffer Overflow Vulnerability

Solution:
The vendor has released fixes. Please see the references for details.

IBM DB2 Administration Server (DAS) Buffer Overflow Vulnerability

References:

• IBM DB2 Homepage (IBM)
  
• IC71203: SECURITY: DB2 DAS REMOTE CODE EXECUTION VULNERABILITY (IBM)
  
• IC72028: SECURITY: DB2 DAS REMOTE CODE EXECUTION VULNERABILITY (IBM)
  
• IC72029: SECURITY: DB2 DAS REMOTE CODE EXECUTION VULNERABILITY (IBM)
  
• ZDI-11-036: IBM DB2 db2dasrrm receiveDASMessage Remote Code Execution Vulnerabil (ZDI Disclosures )
  
• ZDI-11-036 IBM DB2 db2dasrrm receiveDASMessage Remote Code Execution Vulnerabili (Zero Day Initiative)