[UNIX] IBM DB2 Universal Database db2dasStartStopFMDaemon Buffer Overflow Vulnerability

The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.

- - - - - - - - -

IBM DB2 Universal Database db2dasStartStopFMDaemon Buffer Overflow


IBM Corp.'s <http://ibm.com/db2/> DB2 Universal Database product is "a
large database server product commonly used for high-end databases". Local
exploitation of a buffer overflow vulnerability in the db2dasrrm program,
as included with IBM Corp.'s DB2 Universal Database, allows attackers to
elevate privileges to root.


Vulnerable Systems:
* IBM Corp.'s DB2 Universal Database version 9.1 with Fix Pack 4
installed on a Linux system

Immune Systems:
* IBM Corp.'s DB2 Universal Database version 9.1 with Fix Pack 4a
* IBM Corp.'s DB2 Universal Database version 8 with Fix Pack 16
* IBM Corp.'s DB2 Universal Database version 9.5 with Fix Pack 1

This vulnerability exists due to insufficient validation of the length of
the attacker-supplied "DASPROF" environment variable contents. By setting
the variable to a specially crafted string, an attacker can cause a buffer
overflow when the string is copied into a static-sized buffer stored on
the stack. By overflowing the buffer, the attacker can overwrite execution
control structures stored on the stack and execute arbitrary code.

Exploitation allows local attackers to gain root privileges. In order to
exploit this vulnerability, the attacker must have access to execute the
vulnerable set-uid root "db2dasrrm" program.

The best defense against this type of vulnerability is to prevent
untrusted users from having code execution abilities on the respective
database server. The following workarounds may also be useful.

Use a more strict permissions setting for the DB2 instance directory would
prevent non-instance users from accessing the set-uid root binaries.
Remove the set-uid bit from all programs included with DB2.

These configuration changes have not been tested and may cause adverse

Vendor response:
IBM Corp. has addressed this vulnerability with the release of V9.1 Fix
Pack 4a, V8 FixPak 16, and V9.5 Fix Pack 1 of its Universal Database
product. More information can be found at the following URLs.
V8: <http://www-1.ibm.com/support/docview.wss?uid=swg21256235>
V9.1: <http://www-1.ibm.com/support/docview.wss?uid=swg21255572>
V9.5: <http://www-1.ibm.com/support/docview.wss?uid=swg21287889>

CVE Information:

Disclosure timeline:
11/29/2007 - Initial vendor notification
12/01/2007 - Initial vendor response
04/09/2008 - Coordinated public disclosure


The information has been provided by iDefense Labs.
The original article can be found at:


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.