DB2 - Problembeschreibung
Problem IC84753 | Status: Geschlossen |
SECURITY: STACK BUFFER OVERFLOW VULNERABILITY IN JAVA STORED PROCEDURE INFRASTRUCTURE (CVE-2012-2197). | |
Produkt: | |
DB2 FOR LUW / DB2FORLUW / 970 - DB2 | |
Problembeschreibung: | |
A stack buffer overflow vulnerability in Java Stored Procedure infrastructure could be exploited to attain remote code execution. To exploit the vulnerability the malicious user would need: 1) Valid credential to connect to database 2) CONNECT privilege on database 3) A Java stored procedure to which the user has EXECUTE privilege. | |
Problem-Zusammenfassung: | |
**************************************************************** * USERS AFFECTED: * * All DB2 systems on all Linux, Unix and Windows platforms at * * service levels from Version 9.7 GA through to Version 9.7 * * Fix Pack 6. * **************************************************************** * PROBLEM DESCRIPTION: * * See Security Bulletin: Buffer Overflow Vulnerability in IBM * * DB2 Java Stored Procedure Infrastructure (CVE-2012-2197). * * http://www.ibm.com/support/docview.wss?uid=swg21607628 * **************************************************************** * RECOMMENDATION: * * Refer to the following security bulletin to evaluate the * * potential impact in your environment. * * Security Bulletin: Buffer Overflow Vulnerability in IBM DB2 * * SQL/PSM Stored Procedure Infrastructure (CVE-2012-4826). * * http://www.ibm.com/support/docview.wss?uid=swg21614536 * **************************************************************** | |
Local-Fix: | |
verfügbare FixPacks: | |
DB2 Version 9.7 Fix Pack 7 for Linux, UNIX, and Windows | |
Lösung | |
An incomplete fix for this problem was introduced in DB2 Version 9.7 Fix Pack 7. The fix for APAR IC86781 will complete the fix. See Security Bulletin: Buffer Overflow Vulnerability in IBM DB2 SQL/PSM Stored Procedure Infrastructure (CVE-2012-4826). http://www.ibm.com/support/docview.wss?uid=swg21614536 | |
Workaround | |
keiner bekannt / siehe Local-Fix | |
Weitere Daten | |
Datum - Problem gemeldet : Datum - Problem geschlossen : Datum - der letzten Änderung: | 20.06.2012 23.10.2012 19.12.2012 |
Problem behoben ab folgender Versionen (IBM BugInfos) | |
9.7.FP7 | |
Problem behoben lt. FixList in der Version | |
9.7.0.7 |