| CVE ID | |
| CVSS SCORE | |
| AFFECTED VENDORS |
IBM |
| AFFECTED PRODUCTS |
DB2 Universal Database |
| TREND MICRO CUSTOMER PROTECTION | Trend Micro TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID ['8319']. For further product information on the TippingPoint IPS: http://www.tippingpoint.com |
| VULNERABILITY DETAILS |
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM DB2. Authentication is required to exploit this vulnerability. The specific flaw exists in the parsing of VARCHAR arguments to a number of stored procedures available by default on DB2 installations. The vulnerable functions accept VARCHAR(255) strings which are subsequently copied to 218 byte fixed size stack buffers without proper bounds checking resulting in a stack-based buffer overflow. Exploitation can result in system compromise under the credentials of the DB process user. |
| ADDITIONAL DETAILS |
IBM has issued fixes to address this issue. Further details are available at: http://www-01.ibm.com/support/docview.wss?uid=swg1IC61746 |
| DISCLOSURE TIMELINE |
|
| CREDIT | Anonymous |
