Team SHATTER Security Advisory: IBM DB2 UDB Arbitrary code execution in ADMIN_SP_C/ADMIN_SP_C2 procedures

-----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 Team SHATTER Security Advisory IBM DB2 UDB Arbitrary code execution in ADMINSPC/ADMINSPC2 procedures April 17th 2008 Risk Level: High Affected versions: All versions of IBM DB2 Database Server. Remotely exploitable: Yes Authentication to Database Serv...

[SECURITY] Fedora 7 Update: gallery2-2.2.4-3.fc7

The base Gallery 2 installation - the equivalent of upstream's -minimal package. This package requires a database to be operational. Acceptable database backends include MySQL v 3.x, MySQL v 4.x, PostgreSQL v 7.x, PostgreSQL v 8.x, Oracle 9i, Oracle 10g, DB2, and MS SQL Server. All given package...

[SECURITY] Fedora 8 Update: gallery2-2.2.4-3.fc8

The base Gallery 2 installation - the equivalent of upstream's -minimal package. This package requires a database to be operational. Acceptable database backends include MySQL v 3.x, MySQL v 4.x, PostgreSQL v 7.x, PostgreSQL v 8.x, Oracle 9i, Oracle 10g, DB2, and MS SQL Server. All given package...

IBM DB2数据库db2dasrrm缓冲区溢出和文件创建漏洞

BUGTRAQ ID: 27870 CVECAN ID: CVE-2007-5758,CVE-2007-5664 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。...

Stack overflow

Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable...

Information disclosure

db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization...

CVE-2007-5758

Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable...

CVE-2007-5664

db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization...

CVE-2007-5758

Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable...

CVE-2007-5664

DB2 DB2 Administration Server (DAS) component db2dasrrm is vulnerable to a local, symlink-based file-overwrite during initialization. Affected versions are IBM DB2 Universal Database: 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16. The underlying issue allows a local user t...

CVE-2007-5758

CVE-2007-5758 describes a stack-based buffer overflow in the IBM DB2 Universal Database component db2dasrrm (DAS) that can be triggered by a long DASPROF environment variable. Affected are DB2 UDB 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16. Local users could execute arb...

CVE-2007-5664

db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization...

CVE-2007-5758: Improper Restriction of Operations within the Bounds of a Memory Buffer

Stack-based buffer overflow in db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to execute arbitrary code via a long DASPROF environment variable...

[Full-disclosure] iDefense Security Advisory 04.09.08: IBM DB2 Universal Database Administration Server File Creation Vulnerability

iDefense Security Advisory 04.09.08 http://labs.idefense.com/intelligence/vulnerabilities/ Apr 09, 2008 I. BACKGROUND IBM Corp.'s DB2 Universal Database product is a large database server product commonly used for high-end databases. The DB2 Administration Server DAS implements the server compone...

CVE-2007-5664: Improper Link Resolution Before File Access

db2dasrrm in the DB2 Administration Server DAS in IBM DB2 Universal Database 9.5 before Fix Pack 1, 9.1 before Fix Pack 4a, and 8 before FixPak 16 allows local users to overwrite arbitrary files via a symlink attack on files used for initialization...

Privilege escalation

Unspecified vulnerability in IBM DB2 Content Manager before 8.3 FP8 has unknown impact and attack vectors related to the AllowedTrustedLogin privilege...

CVE-2008-1681

Unspecified vulnerability in IBM DB2 Content Manager before 8.3 FP8 has unknown impact and attack vectors related to the AllowedTrustedLogin privilege...

CVE-2008-1681

Technical details about CVE-2008-1681 are not provided in the supplied documents; no affected products, vulnerable components, impact, or fixes are disclosed. Monitor for updates from official advisories.

CVE-2008-1681

Unspecified vulnerability in IBM DB2 Content Manager before 8.3 FP8 has unknown impact and attack vectors related to the AllowedTrustedLogin privilege...

CVE-2008-1681: Undefined Security Weakness

Unspecified vulnerability in IBM DB2 Content Manager before 8.3 FP8 has unknown impact and attack vectors related to the AllowedTrustedLogin privilege...