CVE-2006-4257

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

SecuriTeam™
Beyond Security®

SecuriTeam™ Home
Ask the Team
Mailing Lists
Advertising Info
Blogs

	SecuriTeam™ in Your Inbox

	E-mail this CVE-2006-4257 to a friend

New vulnerability?
New tool?
Tell us

Credit:
The information has been provided by Team SHATTER.
The original article can be found at: http://www.appsecinc.com/resources/alerts/db2/2006-09-05.shtml

Website Security Scan	Code Vulnerability Test	Network Assessment Tool
Detect hidden vulnerabilities	Exhaustive automated testing	Real-time, continuous security
Get guidance from professionals	of internal or 3rd party code.	scanning for your entire network

Check for CVE-2006-4257

Vulnerability Assessment and Management.
Automated Pen Testing for 50 to 50,000 nodes
beyondsecurity.com/vulnerability-scanner

Vulnerable Systems:
* All versions of IBM DB2 Database Server

A malicious CONNECT data stream sent to a DB2 server from V7 client may cause instance crash, resulting in a denial of service. Server crashes with the following stack trace back:
-------Frame------ ------Function + Offset------
0x2022DF24
sqle_db2ra_as_con_database__FP17sqle_db2ra_commonP10sqle_db2raP1
0sqler_glob + 0x268 0x2022D7CC
sqle_db2ra_as_con_driver__FP17sqle_db2ra_commonP10sqle_db2raP10s
qler_glob + 0x2A4 0xDA3AF114 sqledDb2raServerDriver + 0x129C
0xDB3FF900 sqljsDriveRequests__FP13sqle_agent_cbP11UCconHandle +
0x134 0xDB3FC480 sqljsDrdaAsInnerDriver__FP17sqlcc_init_structb
+ 0x2B4 0xDB3FBF60 sqljsDrdaAsDriver__FP17sqlcc_init_struct +
0x10C 0x200464EC sqleRunAgent__FPcUl + 0x578 0xD9598398
sqloCreateEDU__FPFPcUl_vPcUlP13SQLO_EDU_INFOPl + 0x304
0xD9597EF8 sqloSpawnEDU + 0x4CC

Fix:
To fix the problem apply the fixpak 13 for DB2 version 8.1 (same as 8.2 FP6) http://www-306.ibm.com/software/data/db2/udb/support/downloadv8.html

CVE Information:
CVE-2006-4257

Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus