home clear 64x64
en blue 200x116 de orange 200x116 info letter User
suche 36x36
Neueste VersionenFixList
11.1.0.7 FixList
10.5.0.9 FixList
10.1.0.6 FixList
9.8.0.5 FixList
9.7.0.11 FixList
9.5.0.10 FixList
9.1.0.12 FixList
Haben Sie Probleme? - Kontaktieren Sie uns.
Kostenlos registrieren anmeldung-x26
Kontaktformular kontakt-x26

DB2 - Problembeschreibung

Problem IC84753 Status: Geschlossen

SECURITY: STACK BUFFER OVERFLOW VULNERABILITY IN JAVA STORED PROCEDURE
INFRASTRUCTURE (CVE-2012-2197).

Produkt:
DB2 FOR LUW / DB2FORLUW / 970 - DB2
Problembeschreibung:
A stack buffer overflow vulnerability in Java Stored Procedure 
infrastructure could be exploited to attain remote code 
execution. 
 
To exploit the vulnerability the malicious user would need: 
1) Valid credential to connect to database 
2) CONNECT privilege on database 
3) A Java stored procedure to which the user has EXECUTE 
privilege.
Problem-Zusammenfassung:
**************************************************************** 
* USERS AFFECTED:                                              * 
* All DB2 systems on all Linux, Unix and Windows platforms at  * 
* service levels from Version 9.7 GA through to Version 9.7    * 
* Fix Pack 6.                                                  * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* See Security Bulletin: Buffer Overflow Vulnerability in IBM  * 
* DB2 Java Stored Procedure Infrastructure (CVE-2012-2197).    * 
* http://www.ibm.com/support/docview.wss?uid=swg21607628       * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Refer to the following security bulletin to evaluate the     * 
* potential impact in your environment.                        * 
* Security Bulletin: Buffer Overflow Vulnerability in IBM DB2  * 
* SQL/PSM Stored Procedure Infrastructure (CVE-2012-4826).     * 
* http://www.ibm.com/support/docview.wss?uid=swg21614536       * 
****************************************************************
Local-Fix:
verfügbare FixPacks:
DB2 Version 9.7 Fix Pack 7 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 8 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 10 for Linux, UNIX, and Windows

Lösung
An incomplete fix for this problem was introduced in DB2 Version 
9.7 Fix Pack 7. 
The fix for APAR IC86781 will complete the fix. 
See Security Bulletin: Buffer Overflow Vulnerability in IBM DB2 
SQL/PSM Stored Procedure Infrastructure (CVE-2012-4826). 
http://www.ibm.com/support/docview.wss?uid=swg21614536
Workaround
keiner bekannt / siehe Local-Fix
Weitere Daten
Datum - Problem gemeldet    :
Datum - Problem geschlossen :
Datum - der letzten Änderung:
20.06.2012
23.10.2012
19.12.2012
Problem behoben ab folgender Versionen (IBM BugInfos)
9.7.FP7
Problem behoben lt. FixList in der Version
9.7.0.7 FixList