When connecting to a remote DB2 instance, the version 7 client typically sends a SQLJRA packet requesting start of the connection. If this SQLJRA packet is specially crafted, it can cause a DoS attack by crashing the DB2 instance. Altering a few bytes at specific offsets in the packet exposes multiple NULL/invalid pointer dereference bugs in the server code. For example, on Windows, if 0x00 is used at any of these offsets, the sqle_db2ra_as_con_database function (from DB2ENGN.DLL) attempts to access NULL or invalid memory locations, causing an unhandled access violation (0xC0000005). This causes the DB2 instance to crash.
Vulnerable Systems:
* All versions of IBM DB2 Database Server
A malicious CONNECT data stream sent to a DB2 server from V7 client may cause instance crash, resulting in a denial of service. Server crashes with the following stack trace back:
-------Frame------ ------Function + Offset------
0x2022DF24
sqle_db2ra_as_con_database__FP17sqle_db2ra_commonP10sqle_db2raP1
0sqler_glob + 0x268 0x2022D7CC
sqle_db2ra_as_con_driver__FP17sqle_db2ra_commonP10sqle_db2raP10s
qler_glob + 0x2A4 0xDA3AF114 sqledDb2raServerDriver + 0x129C
0xDB3FF900 sqljsDriveRequests__FP13sqle_agent_cbP11UCconHandle +
0x134 0xDB3FC480 sqljsDrdaAsInnerDriver__FP17sqlcc_init_structb
+ 0x2B4 0xDB3FBF60 sqljsDrdaAsDriver__FP17sqlcc_init_struct +
0x10C 0x200464EC sqleRunAgent__FPcUl + 0x578 0xD9598398
sqloCreateEDU__FPFPcUl_vPcUlP13SQLO_EDU_INFOPl + 0x304
0xD9597EF8 sqloSpawnEDU + 0x4CC
