IBM DB2 CVE-2017-1297 Local Buffer Overflow Vulnerability

Bugtraq ID:	99271
Class:	Boundary Condition Error
CVE:	CVE-2017-1297
Remote:	No
Local:	Yes
Published:	Jun 22 2017 12:00AM
Updated:	Oct 15 2018 12:00PM
Credit:	Leon Juranic and Bosko Stankovic of DefenseCode
Vulnerable:	IBM DB2 11.1.2 IBM DB2 9.1 Fixpak 12 IBM DB2 9.1 Fixpack 9 IBM DB2 9.1 Fixpack 8 IBM DB2 9.1 Fixpack 11 IBM DB2 9.1 Fixpack 10 IBM DB2 9.1 IBM DB2 11.1 IBM DB2 10.5 IBM DB2 10.1 Fix Pack 1 IBM DB2 10.1 IBM DB2 10.1
Not Vulnerable:	IBM DB2 11.1.2 FP2 IBM DB2 9.7 FP11 IBM DB2 10.5 FP8 IBM DB2 10.1 FP6

IBM DB2 CVE-2017-1297 Local Buffer Overflow Vulnerability

IBM DB2 is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Successful exploits may allow attackers to execute arbitrary code in context of the application. Failed exploits may result in denial-of-service conditions.

IBM DB2 CVE-2017-1297 Local Buffer Overflow Vulnerability

Currently, we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM DB2 CVE-2017-1297 Local Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

IBM DB2 CVE-2017-1297 Local Buffer Overflow Vulnerability

References:

• IBM Homepage (IBM)
  
• IBM DB2 Command Line Processor Buffer Overflow (Defensecode)
  
• Published Security Vulnerabilities for DB2 for Linux, UNIX, and Windows includin (IBM)
  
• Security Bulletin: IBM® DB2® LUW's Command Line Processor Contains Buffer Overfl (IBM)