Multiple stack-based buffer overflows in IBM DB2 7.x and 8.1 allow local users to execute arbitrary code via (1) a long third argument to the rec2xml function or (2) a long filename argument to the generate_distfile procedure.

The remote host is running a vulnerable version of IBM DB2.

There are multiple remote buffer overflow vulnerabilities in this version that could allow an attacker to cause a denial of service, or possibly execute arbitrary code.

The remote host is running an IBM DB/2 Universal Database Server. It is reported that versions up to 8.2 may be vulnerable to multiple remote overflows.  IBM DB/2 passes database versions over the network. NNM has noted that the DB/2 version is less than 8.2.  

The remote host is running a IBM DB/2 Universal Database Server. It is reported that versions up to and including 8.1 are vulnerable to multiple critical vulnerabilities including multiple remote buffer overflows. Because DB/2 banners sent over the network do not include the installed FixPak number, this alert may be a false positive. 

ID	Name	Product	Family	Severity
15486	IBM DB2 < 8 Fix Pack 7a Multiple Vulnerabilities	Nessus	Databases	critical
2349	IBM DB2 < 8.2 Multiple Vulnerabilities (2) (deprecated)	Nessus Network Monitor	Database	critical
2252	IBM DB2 Multiple Vulnerabilities (deprecated)	Nessus Network Monitor	Database	high

Detections

Analytics

CVE-2004-1372

high

Tenable Plugins

critical

critical

high