CVE-2008-1997

Unspecified vulnerability in the ADMINSPC2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMINSPC issue is already covered by CVE-2008-0699...

CVE-2008-1997

The CVE refers to an issue in IBM DB2’s SYSPROC.ADMIN_SP_C/ADMIN_SP_C2 procedures. Affects IBM DB2 UDB when running versions 8.0–8.0 FP15 (prior to FP16 on 8.x), 9.1 (prior to FP4a), and 9.5 (prior to FP1). Remote authenticated users may execute arbitrary code via unknown vectors due to the ADMIN...

CVE-2008-1998

CVE-2008-1998 affects IBM DB2 prior to FP16 on 8.x, prior to FP4a on 9.1, and prior to FP1 on 9.5 (Windows). The NNSTAT (SYSPROC.NNSTAT) procedure can be abused by remote authenticated users to overwrite arbitrary files via the log file parameter. No explicit exploit details or in-the-wild status...

Buffer overflow

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service instance crash via a call to the 1 RECOVERJAR or 2 REMOVEJAR procedure with a...

CVE-2008-1966

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service instance crash via a call to the 1 RECOVERJAR or 2 REMOVEJAR procedure with a...

CVE-2008-1966

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service instance crash via a call to the 1 RECOVERJAR or 2 REMOVEJAR procedure with a...

CVE-2008-1966

CVE-2008-1966 affects IBM DB2: multiple buffer overflows in the BSU JAVA subcomponent’s JAR file administration routines. Vulnerable in DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1. The issue allows remote authenticated users to cause a denial of service (instance crash) by calling RECO...

IBM DB2数据库ADMIN_SP_C和ADMIN_SP_C2远程代码执行漏洞

BUGTRAQ ID: 28843 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。 DB2的ADMINSPC或ADMINSPC2过程实现上存大漏洞，通过认证的攻击者可以使用DB2默认安装的ADMINSPC或ADMINSPC2过程在数据库中执行任意代码。 IBM DB2 Universal Database 9.5 IBM DB2 Universal Database 9.1 IBM DB2 Universal Database 8.0 IBM ---...

IBM DB2数据库JAR文件处理多个拒绝服务漏洞

BUGTRAQ ID: 28835 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。 DB2的RECOVERJAR和REMOVEJAR过程处理畸形参数数据时存在漏洞，如果用特殊参数调用了RECOVERJAR和REMOVEJAR过程的话，就可能导致DB2例程崩溃。 任何DB2数据库用户都可以利用这个漏洞，因为默认为这两个过程分配了PUBLIC权限。 IBM DB2 Universal Database 9.5 IBM DB2 Universal Database...

IBM DB2数据库NNSTAT过程任意文件覆盖漏洞

BUGTRAQ ID: 28836 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。 DB2默认所安装的NNSTAT过程用于检索昵称的当前可用统计，如果通过认证的攻击者提供已有文件作为日志文件参数的话，就会导致在系统上覆盖任意文件。 IBM DB2 Universal Database 9.5 IBM DB2 Universal Database 9.1 IBM DB2 Universal Database 8.0 IBM ---...

Team SHATTER Security Advisory: Multiple DoS in JAR files manipulation procedures

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory Multiple DoS in JAR files manipulation procedures April 17th 2008 Risk Level: High Affected versions: All versions of IBM DB2 Database Server on Windows platform. Remote exploitable: Yes Authentication to Database Server...

Team SHATTER Security Advisory: IBM DB2 UDB Arbitrary file overwrite in SYSPROC.NNSTAT procedure

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory IBM DB2 UDB Arbitrary file overwrite in SYSPROC.NNSTAT procedure April 17th 2008 Risk Level: High Affected versions: All versions of IBM DB2 Database Server. Remotely exploitable: Yes Authentication to Database Server is...

IBM DB2 database server multiple security vulnerabilities

Privilege escalation with administration utility, db2dasStartStopFMDaemon buffer overflow. JAR files DoS. Code execution with ADMINSPC/ADMINSPC2. Arbitrary files overwrite with SYSPROC.NNSTAT...

Team SHATTER Security Advisory: IBM DB2 UDB Arbitrary code execution in ADMIN_SP_C/ADMIN_SP_C2 procedures

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory IBM DB2 UDB Arbitrary code execution in ADMINSPC/ADMINSPC2 procedures April 17th 2008 Risk Level: High Affected versions: All versions of IBM DB2 Database Server. Remotely exploitable: Yes Authentication to Database Serv...

[SECURITY] Fedora 7 Update: gallery2-2.2.4-3.fc7

The base Gallery 2 installation - the equivalent of upstream's -minimal package. This package requires a database to be operational. Acceptable database backends include MySQL v 3.x, MySQL v 4.x, PostgreSQL v 7.x, PostgreSQL v 8.x, Oracle 9i, Oracle 10g, DB2, and MS SQL Server. All given package...

[SECURITY] Fedora 8 Update: gallery2-2.2.4-3.fc8

The base Gallery 2 installation - the equivalent of upstream's -minimal package. This package requires a database to be operational. Acceptable database backends include MySQL v 3.x, MySQL v 4.x, PostgreSQL v 7.x, PostgreSQL v 8.x, Oracle 9i, Oracle 10g, DB2, and MS SQL Server. All given package...

IBM DB2数据库db2dasrrm缓冲区溢出和文件创建漏洞

BUGTRAQ ID: 27870 CVECAN ID: CVE-2007-5758,CVE-2007-5664 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。...

Information disclosure

db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization...

Stack overflow

Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable...

CVE-2007-5758

Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable...