|
Remote DoS in sqle_db2ra_as_recvrequest
Nov 30, 2006
Risk Level: Medium
Affected versions:
All versions of IBM DB2 Database Server
Credits:
This vulnerability was discovered and researched by Vivek Rathod of Application Security, Inc.
Details:
When connecting to a remote DB2 instance, the version 7 client typically sends a SQLJRA packet requesting start of the connection. A specially crafted SQLJRA packet can cause the DB2 instance to crash. An access violation occurs in sqle_db2ra_as_recvrequest (from DB2ENGN.DLL) when attempting to dereference a NULL pointer.
Impact:
Any remote unauthenticated attacker can crash the DB2 instance.
Vendor Status:
Vendor was contacted and a patch was released.
Fix:
To fix the problem apply the fixpak 14 for DB2 version 8.1 (same as 8.2 FP7)
http://www-306.ibm.com/software/data/db2/udb/support/downloadv8.html
Links:
IBM APAR:
http://www-1.ibm.com/support/docview.wss?uid=swg1IY91847
http://www-1.ibm.com/support/docview.wss?uid=swg1IY86917
|
