Local Vulnerability in IBM DB2 7.1 db2job binary

Title: Local Vulnerability in IBM DB2 7.1 db2job binary Date: 27-07-2003 Platform: Only tested in Linux but can be exported to others. Impact: Users with exec perm over ./db2as/sqllib/adm/db2job can create files with 770 mode and owned by root. Author: Juan Manuel Pascual Escriba [email protected]...

Slight privilege elevation from bin to root in IBM DB2 7.1 - 8.1 all binaries

Title: Local Vulnerability in IBM DB2 7.1 - 8.1 all binaries Date: 27-07-2003 Platform: Only tested in Linux but can be exported to others. Only versions 7.1 and Enterprise Server Edition v8.1 were checked but could affect other versions. Impact: Slight privilege elevation from bin to root. Autho...

IBM DB2 privilege escalation

db2job allows to write any file...

IBM DB2 db2job - File Overwrite

IBM DB2 db2job - File Overwrite source: https://www.securityfocus.com/bid/8344/info IBM's DB2 database ships with a utility called db2job, installed with permissions 4550 and owned by root.db2asgrp. It has been reported that db2job writes to a number of files with root privileges. The files writt...

IBM DB2 db2job - File Overwrite

source: https://www.securityfocus.com/bid/8344/info IBM's DB2 database ships with a utility called db2job, installed with permissions 4550 and owned by root.db2asgrp. It has been reported that db2job writes to a number of files with root privileges. The files written to are created with 0770...

IBM DB2 - Shared Library Injection

source: https://www.securityfocus.com/bid/8346/info IBM DB2 ships with a number of shared libraries, stored in a directory owned by the user and group 'bin'. As setuid root utilities are linked to these libraries, their ownership by a user and group of a lower privilege level constitutes a...

IBM DB2 - Shared Library Injection

IBM DB2 - Shared Library Injection source: https://www.securityfocus.com/bid/8346/info IBM DB2 ships with a number of shared libraries, stored in a directory owned by the user and group 'bin'. As setuid root utilities are linked to these libraries, their ownership by a user and group of a lower...

CVE-2001-1143

CVE-2001-1143 affects IBM DB2 7.0. A remote attacker can cause a denial-of-service (crash) by sending a single byte to (1) db2ccs.exe on port 6790 or (2) db2jds.exe on port 6789. This vulnerability is documented across multiple feeds (NVD, CVE List, Nessus/DOS plugin) with CVSSv2 vector AV:N/AC:L...

CVE-2001-1143

IBM DB2 7.0 allows a remote attacker to cause a denial of service crash via a single byte to 1 db2ccs.exe on port 6790, or 2 db2jds.exe on port 6789...

IBM DB2 Multiple CGI Single Byte Request Remote DoS

It was possible to crash the IBM DB2 database service by connecting to the affected service and sending just one byte to it. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if description scriptid10871; scriptversion"1.23";...

ibm.db2.dos.txt

IBM DB2 for Windows 98/NT/2000 run 2 services : db2ccs.exe listening on port 6790 and db2jds.exe port 6789. I may be wrong but these services are used to access data remotely and to remotely manage the database. Both can be crashed remotely: just telnet on their port, send one byte and then close...

CVE-2001-1143

IBM DB2 7.0 allows a remote attacker to cause a denial of service crash via a single byte to 1 db2ccs.exe on port 6790, or 2 db2jds.exe on port 6789...

IBM Windows DB2 DoS

Hi everybody. IBM DB2 for Windows 98/NT/2000 run 2 services : db2ccs.exe listening on port 6790 and db2jds.exe port 6789. I may be wrong but these services are used to access data remotely and to remotely manage the database. Both can be crashed remotely: just telnet on their port, send one byte...

CVE-2001-0051

IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database...

CVE-2001-0052

IBM DB2 Universal Database version 6.1 allows users to cause a denial of service via a malformed query...

CVE-2001-0051

IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database...

CVE-2001-0052

IBM DB2 Universal Database version 6.1 allows users to cause a denial of service via a malformed query...

CVE-2001-0051

CVE-2001-0051 is linked to IBM DB2 UDB 6.1 where a default account/password enables remote access. Connected docs corroborate generic risk through default-db2 credentials (db2as, db2inst1, db2fenc1, etc.) and multiple related CVEs (CVE-1999-0501, CVE-1999-0502, CVE-2001-0051). OpenVAS/Nessus entr...

CVE-2001-0052

IBM DB2 Universal Database 6.1 is affected by CVE-2001-0052, where a malformed query can cause a denial of service. Affected product: IBM DB2 UDB 6.1. Vulnerability type: denial of service via malformed query. Root cause details are not provided in the supplied documents. Exploitation status and ...

IBM DB2 SQL DOS

1.Description The DB2 Universal Database builds upon the stability and performance of DB2 on the mainframe and provides the features required in a distributed database product. DB2 Universal Database UDB is IBM's relational database server solution for the UNIX, OS/2 and Windows NT/2000 operating...