|
|
|
|
| |
Credit:
The information has been provided by iDefense Labs.
The original article can be found at: http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=689
|
| |
Vulnerable Systems:
* IBM Corp.'s DB2 Universal Database version 9.1 with Fix Pack 4 installed on a Linux system
Immune Systems:
* IBM Corp.'s DB2 Universal Database version 9.1 with Fix Pack 4a
* IBM Corp.'s DB2 Universal Database version 8 with Fix Pack 16
* IBM Corp.'s DB2 Universal Database version 9.5 with Fix Pack 1
This vulnerability exists due to insufficient validation of the length of the attacker-supplied "DASPROF" environment variable contents. By setting the variable to a specially crafted string, an attacker can cause a buffer overflow when the string is copied into a static-sized buffer stored on the stack. By overflowing the buffer, the attacker can overwrite execution control structures stored on the stack and execute arbitrary code.
Analysis:
Exploitation allows local attackers to gain root privileges. In order to exploit this vulnerability, the attacker must have access to execute the vulnerable set-uid root "db2dasrrm" program.
Workaround:
The best defense against this type of vulnerability is to prevent untrusted users from having code execution abilities on the respective database server. The following workarounds may also be useful.
Use a more strict permissions setting for the DB2 instance directory would prevent non-instance users from accessing the set-uid root binaries. Remove the set-uid bit from all programs included with DB2.
These configuration changes have not been tested and may cause adverse behavior.
Vendor response:
IBM Corp. has addressed this vulnerability with the release of V9.1 Fix Pack 4a, V8 FixPak 16, and V9.5 Fix Pack 1 of its Universal Database product. More information can be found at the following URLs.
V8: http://www-1.ibm.com/support/docview.wss?uid=swg21256235
V9.1: http://www-1.ibm.com/support/docview.wss?uid=swg21255572
V9.5: http://www-1.ibm.com/support/docview.wss?uid=swg21287889
CVE Information:
CVE-2007-5758
Disclosure timeline:
11/29/2007 - Initial vendor notification
12/01/2007 - Initial vendor response
04/09/2008 - Coordinated public disclosure
|
|
|
|
|
