Neohapsis is currently accepting applications for employment. For more information, please visit our website www.neohapsis.com or email email@example.com
[VulnDiscuss] ptl-2003-02: IBM DB2 INVOKE Command Stack Overflow Vulnerability
From: Pentest Security Advisories (alertspentest.co.uk)
Date: Wed Oct 01 2003 - 15:11:23 CDT
-----BEGIN PGP SIGNED MESSAGE-----
Pentest Limited Security Advisory
IBM DB2 INVOKE Command Stack Overflow Vulnerability
Title: IBM DB2 INVOKE Command Stack Overflow Vulnerability
Announcement date: 1st October 2003
Advisory Reference: ptl-2003-02
CVE Name: CAN-2003-0837
Product: IBM DB2 Universal Database
Vulnerability Type : Buffer Overflow
Vendor-Status: Fixpack Issued
Remotely Exploitable: Yes
Locally Exploitable: Yes
Advisory URL: http://www.pentest.co.uk/
DB2 is IBM's relational database software. The IBM DB2 INVOKE
command invokes a procedure stored at the location of a database. It
is also known as the Database Application Remote Interface (DARI). The
server procedure executes at the location of the database, and returns
data to the client application.
This command is vulnerable to a stack based overflow that allows an
attacker with "Connect" privileges to the database to execute arbitrary
code on the vulnerable machine in the context of the Administrators group
on Windows NT.
The vulnerability is triggered by issuing a carefully crafted INVOKE
IBM DB2 Universal Data Base v7.2 for Windows is vulnerable.
The vendor has stated that 'the problem was limited to Windows specific
code in v7 that was replaced in v8. So, the vulnerability does not
affect any of the UNIX or Linux versions, nor does it affect version 8.'
- - Pentest Notification: 20-11-2002
- - Notification acknowledged by IBM: 22-11-2002
- - Fixes available from: 17-09-2003
Issue is fixed in Fixpak 10a for DB2 v7.2.
Fixpaks are available at:
This vulnerability was discovered by Matt Moore from Pentest Limited.
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.3 (GNU/Linux)
-----END PGP SIGNATURE-----