IBM DB2 db2dasrrm receiveDASMessage Remote Code Execution VulnerabilityZDI-11-036: January 31st, 2011
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of IBM DB2. Authentication is not required to exploit this vulnerability.
The flaw exists within the db2dasrrm component which listens by default on TCP port 524. When allocating a buffer within receiveDASMessage a user supplied length is used as a parameter to malloc(). This buffer is later copied into without any bounds checking and can be made to overflow. A remote attacker can exploit this vulnerability to execute arbitrary code under the context of the das user user.
Vendor ResponseIBM states:
2010-08-25 - Vulnerability reported to vendor
2011-01-31 - Coordinated public release of advisory
CreditThis vulnerability was discovered by: