IBM DB2 Discovery Service UDP Denial Of Service Vulnerability

Bugtraq ID:	8653
Class:	Failure to Handle Exceptional Conditions
CVE:
Remote:	Yes
Local:	No
Published:	Sep 19 2003 12:00AM
Updated:	Sep 19 2003 12:00AM
Credit:	Discovery of this issue is credited to "Aaron C. Newman" <[email protected]>.
Vulnerable:	IBM DB2 Universal Database for Windows 7.2 IBM DB2 Universal Database for Windows 7.1 IBM DB2 Universal Database for Solaris 7.2 IBM DB2 Universal Database for Solaris 7.1 IBM DB2 Universal Database for Linux 7.2 IBM DB2 Universal Database for Linux 7.1 IBM DB2 Universal Database for HP-UX 7.2 IBM DB2 Universal Database for HP-UX 7.1 IBM DB2 Universal Database for AIX 7.2 IBM DB2 Universal Database for AIX 7.1
Not Vulnerable:

IBM DB2 Discovery Service UDP Denial Of Service Vulnerability

The IBM DB2 Discovery Service is prone to denial of service attacks. If a UDP packet larger than 20 bytes is received by the service, it will shut down. Affected services will need to be restarted to regain normal functionality.

IBM DB2 Discovery Service UDP Denial Of Service Vulnerability

This issue can be exploited with any number of available packet shaping tools.

IBM DB2 Discovery Service UDP Denial Of Service Vulnerability

Solution:
This issue has been addressed in Fixpack 10a for IBM DB2 version 7 on various platforms. Users should contact the vendor for further details on obtaining and applying fixes. The DB2 Technical Support site also provides a fix matrix.

IBM DB2 Discovery Service UDP Denial Of Service Vulnerability

References:

• DB2 Technical Support (IBM)
  
• AppSecInc Security Alert: Denial of Service Vulnerability in DB2 Discovery Servi ("Aaron C. Newman" )