[UNIX] IBM DB2 Universal Database db2dasStartStopFMDaemon Buffer Overflow Vulnerability



The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion

The SecuriTeam alerts list - Free, Accurate, Independent.

Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html

- - - - - - - - -



IBM DB2 Universal Database db2dasStartStopFMDaemon Buffer Overflow
Vulnerability
------------------------------------------------------------------------


SUMMARY

IBM Corp.'s <http://ibm.com/db2/> DB2 Universal Database product is "a
large database server product commonly used for high-end databases". Local
exploitation of a buffer overflow vulnerability in the db2dasrrm program,
as included with IBM Corp.'s DB2 Universal Database, allows attackers to
elevate privileges to root.

DETAILS

Vulnerable Systems:
* IBM Corp.'s DB2 Universal Database version 9.1 with Fix Pack 4
installed on a Linux system

Immune Systems:
* IBM Corp.'s DB2 Universal Database version 9.1 with Fix Pack 4a
* IBM Corp.'s DB2 Universal Database version 8 with Fix Pack 16
* IBM Corp.'s DB2 Universal Database version 9.5 with Fix Pack 1

This vulnerability exists due to insufficient validation of the length of
the attacker-supplied "DASPROF" environment variable contents. By setting
the variable to a specially crafted string, an attacker can cause a buffer
overflow when the string is copied into a static-sized buffer stored on
the stack. By overflowing the buffer, the attacker can overwrite execution
control structures stored on the stack and execute arbitrary code.

Analysis:
Exploitation allows local attackers to gain root privileges. In order to
exploit this vulnerability, the attacker must have access to execute the
vulnerable set-uid root "db2dasrrm" program.

Workaround:
The best defense against this type of vulnerability is to prevent
untrusted users from having code execution abilities on the respective
database server. The following workarounds may also be useful.

Use a more strict permissions setting for the DB2 instance directory would
prevent non-instance users from accessing the set-uid root binaries.
Remove the set-uid bit from all programs included with DB2.

These configuration changes have not been tested and may cause adverse
behavior.

Vendor response:
IBM Corp. has addressed this vulnerability with the release of V9.1 Fix
Pack 4a, V8 FixPak 16, and V9.5 Fix Pack 1 of its Universal Database
product. More information can be found at the following URLs.
V8: <http://www-1.ibm.com/support/docview.wss?uid=swg21256235>
http://www-1.ibm.com/support/docview.wss?uid=swg21256235
V9.1: <http://www-1.ibm.com/support/docview.wss?uid=swg21255572>
http://www-1.ibm.com/support/docview.wss?uid=swg21255572
V9.5: <http://www-1.ibm.com/support/docview.wss?uid=swg21287889>
http://www-1.ibm.com/support/docview.wss?uid=swg21287889

CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5758>
CVE-2007-5758

Disclosure timeline:
11/29/2007 - Initial vendor notification
12/01/2007 - Initial vendor response
04/09/2008 - Coordinated public disclosure


ADDITIONAL INFORMATION

The information has been provided by iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=689>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=689



========================================


This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to: list-unsubscribe@xxxxxxxxxxxxxx
In order to subscribe to the mailing list, simply forward this email to: list-subscribe@xxxxxxxxxxxxxx


====================
====================

DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any kind.
In no event shall we be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages.



Relevant Pages

  • [NT] Microsoft Windows Graphics Device Interface Integer Overflow Vulnerability (MS08-071)
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Microsoft Windows Graphics Device Interface Integer Overflow Vulnerability ... Exploitation allows an attacker to execute arbitrary code with the ... targeted user to view a specially crafted image file. ...
    (Securiteam)
  • [NEWS] @Mail Web Interface Multiple Security Vulnerabilities
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... attacker to point it to mailbox of any registered user in @Mail system. ... Vulnerability 2: SQL database install - Multiple SQL Injection ...
    (Securiteam)
  • [NT] EMC Legato Networker DoS and Multiple Buffer Overflows
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... EMC Legato Networker DoS and Multiple Buffer Overflows ... The vulnerability specifically exists due to improper handling of ... is sent by an attacker, it is possible to overwrite portions of heap ...
    (Securiteam)
  • RE: [COVERT-2001-01] Multiple Vulnerabilities in BIND - FreeBSD Implications ?
    ... Multiple Vulnerabilities in BIND ... BIND 8 contains a buffer overflow that allows a remote attacker to ... This vulnerability has been designated as ...
    (FreeBSD-Security)
  • [UNIX] Sun Microsystems Solaris ld.so doprf() Buffer Overflow Vulnerability
    ... The following security advisory is sent to the securiteam mailing list, and can be found at the SecuriTeam web site: http://www.securiteam.com ... Sun Microsystems Solaris ld.so 'doprf' Buffer Overflow Vulnerability ...
    (Securiteam)