IBM DB2 db2start Command Line Argument Local Overflow

ID EDB-ID:23347
Type exploitdb
Reporter SNOSoft
Modified 2003-11-07T00:00:00


IBM DB2 db2start Command Line Argument Local Overflow. CVE-2003-1050. Dos exploit for linux platform


IBM DB2 has been reported to be prone to multiple buffer overflow vulnerabilities that present themselves in binaries that are shipped with DB2. The vulnerabilities are likely caused due to a lack of sufficient boundary checks performed on user supplied command-line arguments before they are copied into a reserved buffer in memory. It has been reported that by supplying arguments of excessive length to the respective vulnerable executables a local attacker may trigger the execution of arbitrary attacker-supplied instructions with elevated privileges. 

[kf@RiotStarter adm]$ source /home/db2inst1/sqllib/db2profile
[kf@RiotStarter adm]$ ./db2start `perl -e 'print "A" x 9901'`
Segmentation fault