IBM DB2 Administration Server (DAS) 'validateUser()' Stack Buffer Overflow Vulnerability

Bugtraq ID:	46077
Class:	Boundary Condition Error
CVE:	CVE-2010-3731
Remote:	Yes
Local:	No
Published:	Jan 31 2011 12:00AM
Updated:	Mar 19 2015 07:35AM
Credit:	Intevydis
Vulnerable:
Not Vulnerable:

IBM DB2 Administration Server (DAS) 'validateUser()' Stack Buffer Overflow Vulnerability

IBM DB2 is prone to a stack-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied input.

Attackers may leverage this issue to execute arbitrary code in the context of the application. Failed attacks will cause denial-of-service conditions.

The following versions of DB2 are vulnerable:

DB2 9.1 prior to Fix Pack 10
DB2 9.5 prior to Fix Pack 6
DB2 9.7 prior to Fix Pack 3

IBM DB2 Administration Server (DAS) 'validateUser()' Stack Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM DB2 Administration Server (DAS) 'validateUser()' Stack Buffer Overflow Vulnerability

Solution:
The vendor has released fixes. Please see the references for details.

IBM DB2 Administration Server (DAS) 'validateUser()' Stack Buffer Overflow Vulnerability

References:

• IBM DB2 Homepage (IBM)
  
• ZDI-11-035 IBM DB2 db2dasrrm validateUser Remote Code Execution Vulnerability (Zero Day Initiative)
  
• ZDI-11-035: IBM DB2 db2dasrrm validateUser Remote Code Execution Vulnerability (ZDI Disclosures )
  
• IC69986: SECURITY: REMOTE BUFFER OVERFLOW VULNERABILITY IN DB2 ADMINISTRATIVE SE (IBM)
  
• IC70538: SECURITY: REMOTE BUFFER OVERFLOW VULNERABILITY IN DB2 ADMINISTRATIVE SE (IBM)
  
• IC70539: SECURITY: REMOTE BUFFER OVERFLOW VULNERABILITY IN DB2 ADMINISTRATIVE SE (IBM)