TippingPoint Zero Day Initiative
 

IBM DB2 Universal Database Multiple SQL Functions Remote Code Execution Vulnerabilities

ZDI-09-100: December 15th, 2009

Affected Vendors

Affected Products

TippingPoint™ IPS Customer Protection

TippingPoint IPS customers are protected against this vulnerability by Digital Vaccine protection filter ID 8319. For further product information on the TippingPoint IPS:

Vulnerability Details

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM DB2. Authentication is required to exploit this vulnerability.

The specific flaw exists in the parsing of VARCHAR arguments to a number of stored procedures available by default on DB2 installations. The vulnerable functions accept VARCHAR(255) strings which are subsequently copied to 218 byte fixed size stack buffers without proper bounds checking resulting in a stack-based buffer overflow. Exploitation can result in system compromise under the credentials of the DB process user.

Vendor Response

IBM states:

IBM has issued fixes to address this issue. Further details are available at:

http://www-01.ibm.com/support/docview.wss?uid=swg1IC61746
http://www-01.ibm.com/support/docview.wss?uid=swg1IC61962
http://www-01.ibm.com/support/docview.wss?uid=swg1IC62625
http://www-01.ibm.com/support/docview.wss?uid=swg1IC63525


Disclosure Timeline

    2009-06-23 - Vulnerability reported to vendor
    2009-12-15 - Coordinated public release of advisory

Credit

This vulnerability was discovered by:
    Anonymous