IBM DB2 db2ckpw Buffer Overflow Vulnerability

Bugtraq ID:	4817
Class:	Boundary Condition Error
CVE:	CVE-2002-1583
Remote:	No
Local:	Yes
Published:	May 24 2002 12:00AM
Updated:	Jul 11 2009 12:46PM
Credit:	Announced in IBM Security Advisory MSS-OAR-E01-2002:318.1.
Vulnerable:	IBM DB2 Universal Database for Solaris 7.2 IBM DB2 Universal Database for Solaris 7.1 IBM DB2 Universal Database for Solaris 7.0 IBM DB2 Universal Database for Solaris 6.1 IBM DB2 Universal Database for Solaris 6.0 IBM DB2 Universal Database for Linux 7.2 IBM DB2 Universal Database for Linux 7.1 IBM DB2 Universal Database for Linux 7.0 IBM DB2 Universal Database for Linux 6.1 - Caldera OpenLinux 2.4 - Redhat Linux 7.0 - SuSE Linux 7.0 - Turbolinux Turbolinux 6.0.4 IBM DB2 Universal Database for Linux 6.0 IBM DB2 Universal Database for HP-UX 7.2 IBM DB2 Universal Database for HP-UX 7.1 IBM DB2 Universal Database for HP-UX 7.0 IBM DB2 Universal Database for HP-UX 6.1 IBM DB2 Universal Database for HP-UX 6.0 IBM DB2 Universal Database for AIX 7.2 IBM DB2 Universal Database for AIX 7.1 IBM DB2 Universal Database for AIX 7.0 IBM DB2 Universal Database for AIX 6.1 IBM DB2 Universal Database for AIX 6.0
Not Vulnerable:

IBM DB2 db2ckpw Buffer Overflow Vulnerability

Solution:
IBM has released FixPaks:


IBM DB2 Universal Database for AIX 6.0

• IBM FP10_U482111
  FixPack 10 for DB2 V6 for AIX.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aixv61/ FP10_U482111/

IBM DB2 Universal Database for Linux 6.0

• IBM FP10_IP22471
  FixPack 10 for DB2 V6 for Linux.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2linuxv6 1/FP10_IP22471/

IBM DB2 Universal Database for HP-UX 6.0

• IBM FP10_U482113
  FixPack 10 for DB2 V6 for HP-UX 10.x.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hp10v61 /FP10_U482113/


• IBM FP10_U482114
  FixPack 10 for DB2 V6 for HP-UX 11.x.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hp11v61 /FP10_U482114/

IBM DB2 Universal Database for Solaris 6.0

• IBM FP10_U482112
  FixPack 10 for DB2 V6 for Solaris.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2sunv61/ FP10_U482112/

IBM DB2 Universal Database for AIX 6.1

• IBM FP10_U482111
  FixPack 10 for DB2 V6 for AIX.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aixv61/ FP10_U482111/

IBM DB2 Universal Database for HP-UX 6.1

• IBM FP10_U482113
  FixPack 10 for DB2 V6 for HP-UX 10.x.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hp10v61 /FP10_U482113/


• IBM FP10_U482114
  FixPack 10 for DB2 V6 for HP-UX 11.x.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hp11v61 /FP10_U482114/

IBM DB2 Universal Database for Linux 6.1

• IBM FP10_IP22471
  FixPack 10 for DB2 V6 for Linux.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2linuxv6 1/FP10_IP22471/

IBM DB2 Universal Database for Solaris 6.1

• IBM FP10_U482112
  FixPack 10 for DB2 V6 for Solaris.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2sunv61/ FP10_U482112/

IBM DB2 Universal Database for Solaris 7.0

• IBM FP6_U481409
  FixPack 6 for DB2 V7 for Solaris.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2sunv7/F P6_U481409/


• IBM FP6_U481410
  FixPack 6 for DB2 V7 for Solaris (64-bit).
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2sun64v7 /FP6_U481410/

IBM DB2 Universal Database for HP-UX 7.0

• IBM FP6_U481411
  FixPack 6 for DB2 V7 for HP-UX 11.x.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hpv7/FP 6_U481411/


• IBM FP6_U481412
  FixPack 6 for DB2 V7 for HP64.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hp64v7/ FP6_U481412/

IBM DB2 Universal Database for Linux 7.0

• IBM FP6_U481413
  FixPack 6 for DB2 V7 for Linux.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2linuxv7 /FP6_U481413/


• IBM FP6_MI00038
  FixPack 6 for DB2 V7 for Linux390.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2linux39 0v7/FP6_MI00038/

IBM DB2 Universal Database for AIX 7.0

• IBM FP6_U481406
  FixPack 6 for DB2 V7 for AIX.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aixv7/F P6_U481406/


• IBM FP6_U481407
  FixPack 6 for DB2 V7 for AIX43-64.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aix43-6 4v7/FP6_U481407/


• IBM FP6_U481408
  FixPack 6 for DB2 V7 for AIX5-64.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aix5-64 v7/FP6_U481408/

IBM DB2 Universal Database for Solaris 7.1

• IBM FP6_U481409
  FixPack 6 for DB2 V7 for Solaris.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2sunv7/F P6_U481409/


• IBM FP6_U481410
  FixPack 6 for DB2 V7 for Solaris (64-bit).
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2sun64v7 /FP6_U481410/

IBM DB2 Universal Database for Linux 7.1

• IBM FP6_U481413
  FixPack 6 for DB2 V7 for Linux.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2linuxv7 /FP6_U481413/


• IBM FP6_MI00038
  FixPack 6 for DB2 V7 for Linux390.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2linux39 0v7/FP6_MI00038/

IBM DB2 Universal Database for AIX 7.1

• IBM FP6_U481406
  FixPack 6 for DB2 V7 for AIX.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aixv7/F P6_U481406/


• IBM FP6_U481407
  FixPack 6 for DB2 V7 for AIX43-64.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aix43-6 4v7/FP6_U481407/


• IBM FP6_U481408
  FixPack 6 for DB2 V7 for AIX5-64.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aix5-64 v7/FP6_U481408/

IBM DB2 Universal Database for HP-UX 7.1

• IBM FP6_U481411
  FixPack 6 for DB2 V7 for HP-UX 11.x.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hpv7/FP 6_U481411/


• IBM FP6_U481412
  FixPack 6 for DB2 V7 for HP64.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hp64v7/ FP6_U481412/

IBM DB2 Universal Database for Linux 7.2

• IBM FP6_U481413
  FixPack 6 for DB2 V7 for Linux.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2linuxv7 /FP6_U481413/


• IBM FP6_MI00038
  FixPack 6 for DB2 V7 for Linux390.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2linux39 0v7/FP6_MI00038/

IBM DB2 Universal Database for AIX 7.2

• IBM FP6_U481406
  FixPack 6 for DB2 V7 for AIX.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aixv7/F P6_U481406/


• IBM FP6_U481407
  FixPack 6 for DB2 V7 for AIX43-64.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aix43-6 4v7/FP6_U481407/


• IBM FP6_U481408
  FixPack 6 for DB2 V7 for AIX5-64.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aix5-64 v7/FP6_U481408/

IBM DB2 Universal Database for Solaris 7.2

• IBM FP6_U481409
  FixPack 6 for DB2 V7 for Solaris.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2sunv7/F P6_U481409/


• IBM FP6_U481410
  FixPack 6 for DB2 V7 for Solaris (64-bit).
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2sun64v7 /FP6_U481410/

IBM DB2 Universal Database for HP-UX 7.2

• IBM FP6_U481411
  FixPack 6 for DB2 V7 for HP-UX 11.x.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hpv7/FP 6_U481411/


• IBM FP6_U481412
  FixPack 6 for DB2 V7 for HP64.
  ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2hp64v7/ FP6_U481412/