IBM DB2 for Linux, UNIX and Windows 9.2, 10.1, 10.5, and 11.1 (includes DB2 Connect Server) is vulnerable to a buffer overflow that could allow a local user to overwrite DB2 files or cause a denial of service. IBM X-Force ID: 120668.

According to its version, the installation of IBM DB2 running on the remote host is either 9.7 prior to fix pack 11 Special Build 36792, 10.1 prior to fix pack 6 Special Build 36792, 10.5 prior to fix pack 7 Special Build 36792, or 11.1.2.2 prior to fix pack 2 Special Build 36792. It is, therefore, affected by a vulnerability that allows a user without proper authority to activate the database as described in the advisory.

According to its version, the installation of IBM DB2 Connect on the remote Windows host is either 9.7 prior to Fix Pack 11 Special Build 36621, 10.1 prior to Fix Pack 6 Special Build 36610, 10.5 prior to Fix Pack 8 Special Build 36605, or 11.1.2 prior to Fix Pack 2. It is, therefore, affected by the following vulnerabilities :

  - A buffer overflow condition exists due to improper     validation of user-supplied input. A local attacker can     exploit this to overwrite DB2 files or cause a denial of     service condition. (CVE-2017-1105)

  - A stack-based buffer overflow condition exists in the     Command Line Process (CLP) due to improper bounds     checking. A local attacker can exploit this to execute     arbitrary code. (CVE-2017-1297)

According to its version, the installation of IBM DB2 on the remote Windows host is either 9.7 prior to Fix Pack 11 Special Build 36621, 10.1 prior to Fix Pack 6 Special Build 36610, 10.5 prior to Fix Pack 8 Special Build 36605, or 11.1.2 prior to Fix Pack 2. It is, therefore, affected by the following vulnerabilities :

  - A buffer overflow condition exists due to improper     validation of user-supplied input. A local attacker can     exploit this to overwrite DB2 files or cause a denial of     service condition. (CVE-2017-1105)

  - A stack-based buffer overflow condition exists in the     Command Line Process (CLP) due to improper bounds     checking. A local attacker can exploit this to execute     arbitrary code. (CVE-2017-1297)

According to its version, the installation of IBM DB2 running on the remote host is either 9.7 prior to Fix Pack 11 Special Build 36621, 10.1 prior to Fix Pack 6 Special Build 36610, 10.5 prior to Fix Pack 8 Special Build 36605, or 11.1.2 prior to Fix Pack 2. It is, therefore, affected by the following vulnerabilities :

  - A buffer overflow condition exists due to improper     validation of user-supplied input. A local attacker can     exploit this to overwrite DB2 files or cause a denial of     service condition. (CVE-2017-1105)

  - A stack-based buffer overflow condition exists in the     Command Line Process (CLP) due to improper bounds     checking. A local attacker can exploit this to execute     arbitrary code. (CVE-2017-1297)

ID	Name	Product	Family	Severity
103253	IBM DB2 9.7 < FP11 Special Build 36792 / 10.1 < FP6 Special Build 36792 / 10.5 < FP8 Special Build 36792 / 11.1.2.2 < FP2 Special Build 36792 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
101163	IBM DB2 Connect 9.7 < FP11 Special Build 36621 / 10.1 < FP6 Special Build 36610 / 10.5 < FP8 Special Build 36605 / 11.1.2 < FP2 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
101162	IBM DB2 9.7 < FP11 Special Build 36621 / 10.1 < FP6 Special Build 36610 / 10.5 < FP8 Special Build 36605 / 11.1.2 < FP2 Multiple Vulnerabilities (Windows)	Nessus	Windows	high
101161	IBM DB2 9.7 < FP11 Special Build 36621 / 10.1 < FP6 Special Build 36610 / 10.5 < FP8 Special Build 36605 / 11.1.2 < FP2 Multiple Vulnerabilities (UNIX)	Nessus	Databases	high

Detections

Analytics

CVE-2017-1105

high

Tenable Plugins

high

high

high

high