Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service (instance crash) via a call to the (1) RECOVERJAR or (2) REMOVE_JAR procedure with a crafted parameter, related to (a) sqlj.install_jar and (b) sqlj.replace_jar.

The installation of IBM DB2 on the remote host 9.5 is prior to Fix Pack 1 and is affected by one or more of the following vulnerabilities :

 - There is a security vulnerability in the 'NNSTAT' procedure on Windows platforms that allows low-privileged users to overwrite arbitrary files (IZ10776)
 - There is a security vulnerability in the 'SYSPROC.ADMIN_SP_C' procedure on Windows platforms that allows users to load arbitrary libraries and execute arbitrary code in the system (IZ10917)
 - An unspecified vulnerability affects 'DB2WATCH' and 'DB2FREEZE' on Solaris platforms (IZ12994)
 - A flaw exists as the db2ls command creates temporary files insecurely. It is possible for a local attacker to use a symlink attack against the FILE file to cause the program to unexpectedly write to any file on the system. (IZ14939)
 - An authenticated remote user can cause the DB2 instance to crash by passing specially crafted parameters to the 'RECOVERJAR' and 'REMOVE_JAR' procedures (IZ15496)
 - There is an internal buffer overflow vulnerability in the DAS process that could allow arbitrary code execution on the affected host (IZ12406)
 - A local attacker can create arbitrary files as root on Unix and Linux platforms using symlinks to the 'dasRecoveryIndex', 'dasRecoveryIndex.tmp', '.dasRecoveryIndex.lock', and 'dasRecoveryIndex.cor' files during initialization (IZ12798)
 - There is a security vulnerability related to a failure to switch the owner of the 'db2fmp' process affecting Unix and Linux platforms (IZ19155)
 - When a memory dump occurs, the password used to connect to the database remains visible in clear text in memory (JR28314)

The installation of IBM DB2 9.5 running on the remote host does not have any Fix Packs applied. It is, therefore, affected by one or more of the following issues :

  - There is a security vulnerability in the 'NNSTAT'     procedure on Windows platforms only that allows low-     privileged users to overwrite arbitrary files.
    (IZ10776)

  - There is a security vulnerability in the     'SYSPROC.ADMIN_SP_C' procedure on Windows platforms     that allows users to load arbitrary library and     execute arbitrary code in the system. (IZ10917)

  - An unspecified vulnerability affects 'DB2WATCH' and     'DB2FREEZE' on Solaris platforms. (IZ12994)

  - An authenticated, remote user can cause the DB2 instance     to crash by passing specially crafted parameters to     the 'RECOVERJAR' and 'REMOVE_JAR' procedures. (IZ15496)

  - There is an internal buffer overflow vulnerability in     the DAS process that could allow arbitrary code     execution on the affected host. (IZ12406)

  - A local attacker can create arbitrary files as root     on Unix and Linux platforms using symlinks to the     'dasRecoveryIndex', 'dasRecoveryIndex.tmp',     '.dasRecoveryIndex.lock', and 'dasRecoveryIndex.cor'     files during initialization. (IZ12798)

  - There are possible buffer overflows involving 'XQUERY',     'XMLQUERY', 'XMLEXISTS', and 'XMLTABLE'. (IZ18431)

  - There is a security vulnerability related to a     failure to switch the owner of the 'db2fmp' process     affecting Unix and Linux platforms. (IZ19155)

  - When a memory dump occurs, the password used to connect     to the database remains visible in plaintext in the     memory dump file. (JR28314)

  - The CLR stored procedure deployment feature of IBM     Database Add-Ins for Visual Studio can be used to     escalate privileges or launch a denial of service     attack against a DB2 server. (JR28431)

  - A flaw exists in the db2ls command that allows a local     attacker to write to any file on the system through the     use of symbolic links. Note that this issue does not     affect Windows systems. (IZ14939)

According to its version, the installation of IBM DB2 on the remote host is affected by one or more of the following vulnerabilities : 

  - There is an unspecified security vulnerability related to a 'DB2FMP' process (IZ20352).
  - There is an unspecified security vulnerability in a CLR-stored procedure deployment from IBM Database Add-Ins for Visual Studio (JR28432).
  - The password used to connect to the database can be seen in plaintext in a memory dump (JR27422).
  - There is a possible stack variable overrun in 'SQLRLAKA()' (IZ16346).
  - A local privilege escalation vulnerability via file creation can result in root-level access (IZ12735).
  - There are possible buffer overflows involving 'XQUERY',  'XMLQUERY', 'XMLEXISTS', and 'XMLTABLE' (IZ18434).

ID	Name	Product	Family	Severity
4612	IBM DB2 9.5 < 9.5 Fix Pack 1 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
33763	IBM DB2 < 9.5 Fix Pack 1 Multiple Vulnerabilities	Nessus	Databases	critical
4536	IBM DB2 9.x < 9 Fix Pack 5 Multiple Vulnerabilities	Nessus Network Monitor	Database	critical

Detections

Analytics

CVE-2008-1966

medium

Tenable Plugins

high

critical

critical