CVE-2007-1089: Undefined Security Weakness

IBM DB2 Universal Database UDB 9.1 GA through 9.1 FP1 allows local users with table SELECT privileges to perform unauthorized UPDATE and DELETE SQL commands via unknown vectors...

IBM DB2 < 9 Fix Pack 2 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 running on the remote host allows unsafe access to several setuid-root binaries. A local attacker can exploit this to crash the affected database server or possibly even gain root-level access. In addition, the fenced userid may be able to...

CVE-2007-1087: Improper Restriction of Operations within the Bounds of a Memory Buffer

IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 does not properly terminate certain input strings, which allows local users to execute arbitrary code via unspecified environment variables that trigger a heap-based buffer overflow...

IBM DB2 9.1 < 9.1 Fix Pack 2 Multiple Vulnerabilities

Binary data 3921.prm...

CVE-2007-1086: Undefined Security Weakness

Unspecified binaries in IBM DB2 8.x before 8.1 FixPak 15 and 9.1 before Fix Pack 2 allow local users to create or modify arbitrary files via unspecified environment variables related to "unsafe file access."...

IBM DB2 database symboli links

Symboli links problem on temporary files creation...

Design/Logic Flaw

Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file...

CVE-2007-1027

Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file...

CVE-2007-1027

Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file...

CVE-2007-1027

CVE-2007-1027 affects IBM DB2 prior to 9 Fix Pack 2 for Linux/Unix. The vulnerability arises from a symlink attack on the temporary file DB2DIAG.LOG, allowing local users to overwrite arbitrary files via setuid DB2 binaries. The description in the provided documents confirms a local-privilege con...

CVE-2007-1027: Improper Link Resolution Before File Access

Certain setuid DB2 binaries in IBM DB2 before 9 Fix Pack 2 for Linux and Unix allow local users to overwrite arbitrary files via a symlink attack on the DB2DIAG.LOG temporary file...

Fedora Core 5 : mono-1.1.13.7-2.fc5.1 (2006-1012)

CVE-2006-5072 Mono insecure temporary file usage Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues...

IBM DB2 < 8.1 FixPak 12 EXCSAT Long MGRLVLLS Message Remote DoS

According to its version, the installation of IBM DB2 running on the remote host may crash when it attempts to process a specially crafted CONNECT or ATTACH request sent during the initial handshake process. An unauthenticated, remote attacker can exploit this issue to overflow a buffer and crash...

IBM DB2 < 8.1 Fix Pack 14 Multiple Vulnerabilities

According to its version, the installation of IBM DB2 running on the remote host may crash when processing specially crafted SQLJRA packets because it attempts to dereference a NULL pointer in the sqledb2raasrecvrequest function. A remote attacker can send such packets without authentication to...

IBM DB2 < 8.1 Fix Pack 13 CONNECT Processing Unspecified DoS

According to its version, the installation of IBM DB2 running on the remote host may crash in certain scenarios, such as when a user connects using a specially crafted ACCSEC command during the handshake process. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc...

IBM DB2远程DQLJRA包拒绝服务漏洞

IBM DB2 Database Server是一款流行的数据库服务程序。 IBM DB2 Database Server sqledb2raasrecvrequest请求处理存在问题，远程攻击者可利用此漏洞对服务程序进行拒绝服务攻击。 当连接远程DB2实例，版本7客户端一般会发送一个SQLJRA包请求启动连接，不过一个特殊构建的SQLJRA包可引起DB2实例崩溃，在当引用一个NULL指针时sqledb2raasrecvrequest 来自DB2ENGN.DLL出现访问冲突错误。 IBM DB2 Universal Database Win98/NT/2000 7.0 IBM DB2...

CVE-2006-6638

IBM DB2 8.1 before FixPak 14 allows remote attackers to cause a denial of service via a crafted SQLJRA packet, which causes a NULL pointer dereference in the sqledb2raasrecvrequest function in DB2ENGN.DLL, a different issue than CVE-2006-4257...

CVE-2006-6638

IBM DB2 8.1 before FixPak 14 allows remote attackers to cause a denial of service via a crafted SQLJRA packet, which causes a NULL pointer dereference in the sqledb2raasrecvrequest function in DB2ENGN.DLL, a different issue than CVE-2006-4257...

CVE-2006-6638

CVE-2006-6638 affects IBM DB2 UDB 8.1 before FixPak 14. A remote attacker can trigger a denial of service by sending a crafted SQLJRA packet, leading to a NULL pointer dereference in the sqle_db2ra_as_recvrequest function in DB2ENGN.DLL. This is the same issue described in CVE-2006-4257 family bu...

CVE-2006-6638: Undefined Security Weakness

IBM DB2 8.1 before FixPak 14 allows remote attackers to cause a denial of service via a crafted SQLJRA packet, which causes a NULL pointer dereference in the sqledb2raasrecvrequest function in DB2ENGN.DLL, a different issue than CVE-2006-4257...