Signature Detail
Short Name |
DB:DB2:SQL-REPEAT-OF |
|---|---|
Severity |
High |
Recommended |
No |
Recommended Action |
Drop |
Category |
DB |
Keywords |
IBM DB2 Database Server SQL REPEAT Buffer Overflow |
Release Date |
2010/10/01 |
Update Number |
1784 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
DB: IBM DB2 Database Server SQL REPEAT Buffer Overflow
This signature detects attempts to exploit a known heap buffer overflow vulnerability in IBM's DB2 Database Server. It is due to an integer overflow that can occur when malicious input is processed by the REPEAT function. By sending a crafted SQL query to the target server an attacker can exploit this and execute arbitrary code.
Extended Description
IBM DB2 is prone to a heap-based buffer-overflow vulnerability because the application fails to perform adequate boundary checks on user-supplied data. Attackers can exploit this issue to execute arbitrary code with elevated privileges or crash the affected application. The issue affects the following: IBM DB2 versions prior to 9.1 Fix Pack 9 IBM DB2 9.7 Other versions may also be affected.
Affected Products
- IBM DB2 Universal Database 9.1
- IBM DB2 Universal Database 9.1 Fix Pack 4A
- IBM DB2 Universal Database 9.1 Fix Pack 6
- IBM DB2 Universal Database 9.1 Fix Pack 6A
- IBM DB2 Universal Database 9.1 Fix Pack 7
- IBM DB2 Universal Database 9.1 Fix Pack 8
- IBM DB2 Universal Database 9.1 FP5
- IBM DB2 Universal Database 9.7
- IBM DB2 Universal Database 9.7.1
- IBM Tivoli Storage Manager 6.2
- IBM Tivoli Storage Manager 6.2.1
References
- BugTraq: 37976
- CVE: CVE-2010-0462