Security News -  Security Reviews -   Exploits -  Tools -  UNIX Focus -  Windows Focus
SecuriTeam™  Beyond Security®  SecuriTeam™ Home  Ask the Team  Mailing Lists  Advertising Info  Blogs SecuriTeam™ in Your Inbox   E-mail this CVE-2007-5664 to a friend New vulnerability? New tool? Tell us	CVE-2007-5664 IBM DB2 Universal Database Administration Server File Creation Vulnerability     Credit: The information has been provided by iDefense Labs. The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=688 Website Security Scan Code Vulnerability Test Network Assessment Tool Detect hidden vulnerabilities Exhaustive automated testing Real-time, continuous security Get guidance from professionals of internal or 3rd party code. scanning for your entire network    CVE-2007-5664 Details Check for CVE-2007-5664 Vulnerability Assessment and Management. Automated Pen Testing for 50 to 50,000 nodes beyondsecurity.com/vulnerability-scanner Vulnerable Systems:  * IBM Corp.'s DB2 Universal Database 9.1 release with Fix Pack 3 installed on Linux Immune Systems:  * IBM Corp.'s DB2 Universal Database 9.1 release with Fix Pack 4a  * IBM Corp.'s DB2 Universal Database 8 release with Fix Pack 16  * IBM Corp.'s DB2 Universal Database 9.5 release with Fix Pack 1 This vulnerability exists due to unsafe file access from within the db2dasrrm program. When a user starts the DAS, the "db2dasrrm" process is started with root privileges. As part of the initialization, the "dasRecoveryIndex", "dasRecoveryIndex.tmp", ".dasRecoveryIndex.lock", and "dasRecoveryIndex.cor" files are created with root privileges. By removing and re-creating these files as symbolic links, an attacker can create arbitrary files as root. Analysis: Exploitation allows local attackers to gain root privileges. In order to exploit this vulnerability, an attacker must have access to an account that is allowed to start and stop the DB2 Administration Server. For example, the "dasusr1" account or an account with access to the "db2adm1" group. It should be noted that an attacker does not appear to have any control over the contents of the data written. However, this does not significantly impact exploitation since the file is created using the user's umask and group. Vendor response: IBM Corp. has addressed this vulnerability with the release of V9.1 Fix Pack 4a, V8 FixPak 16, and V9.5 Fix Pack 1 of its Universal Database product. More information can be found at the following URLs. V8: http://www-1.ibm.com/support/docview.wss?uid=swg21256235 V9.1: http://www-1.ibm.com/support/docview.wss?uid=swg21255572 V9.5: http://www-1.ibm.com/support/docview.wss?uid=swg21287889 CVE Information: CVE-2007-5664 Disclosure Timeline: 10/03/2007 - Initial vendor notification 10/16/2007 - Initial vendor response 04/09/2008 - Coordinated public disclosure  Comments on CVE-2007-5664:  Add new comment:  Subject:  Name/Nick/Email:          Chars Left:	All Sections Security News Unix focus Exploits Tools Windows focus Security Reviews
	Security News - Security Reviews - Exploits - Tools - UNIX Focus - Windows Focus

Copyright © 1998-2010 Beyond Security® All rights reserved.
Terms of Use Site Privacy Statement.
SecuriTeam™ is a trademark of Beyond Security®