The following security advisory is sent to the securiteam mailing list, and can
be found at the SecuriTeam web site: http://www.securiteam.com
- - promotion
The SecuriTeam alerts list - Free, Accurate, Independent.
Get your security news from a reliable source.
http://www.securiteam.com/mailinglist.html
- - - - - - - - -
IBM DB2 Universal Database db2dasStartStopFMDaemon Buffer Overflow
Vulnerability
------------------------------------------------------------------------
SUMMARY
IBM Corp.'s <http://ibm.com/db2/> DB2 Universal Database product is "a
large database server product commonly used for high-end databases". Local
exploitation of a buffer overflow vulnerability in the db2dasrrm program,
as included with IBM Corp.'s DB2 Universal Database, allows attackers to
elevate privileges to root.
DETAILS
Vulnerable Systems:
* IBM Corp.'s DB2 Universal Database version 9.1 with Fix Pack 4
installed on a Linux system
Immune Systems:
* IBM Corp.'s DB2 Universal Database version 9.1 with Fix Pack 4a
* IBM Corp.'s DB2 Universal Database version 8 with Fix Pack 16
* IBM Corp.'s DB2 Universal Database version 9.5 with Fix Pack 1
This vulnerability exists due to insufficient validation of the length of
the attacker-supplied "DASPROF" environment variable contents. By setting
the variable to a specially crafted string, an attacker can cause a buffer
overflow when the string is copied into a static-sized buffer stored on
the stack. By overflowing the buffer, the attacker can overwrite execution
control structures stored on the stack and execute arbitrary code.
Analysis:
Exploitation allows local attackers to gain root privileges. In order to
exploit this vulnerability, the attacker must have access to execute the
vulnerable set-uid root "db2dasrrm" program.
Workaround:
The best defense against this type of vulnerability is to prevent
untrusted users from having code execution abilities on the respective
database server. The following workarounds may also be useful.
Use a more strict permissions setting for the DB2 instance directory would
prevent non-instance users from accessing the set-uid root binaries.
Remove the set-uid bit from all programs included with DB2.
These configuration changes have not been tested and may cause adverse
behavior.
Vendor response:
IBM Corp. has addressed this vulnerability with the release of V9.1 Fix
Pack 4a, V8 FixPak 16, and V9.5 Fix Pack 1 of its Universal Database
product. More information can be found at the following URLs.
V8: <http://www-1.ibm.com/support/docview.wss?uid=swg21256235>
http://www-1.ibm.com/support/docview.wss?uid=swg21256235
V9.1: <http://www-1.ibm.com/support/docview.wss?uid=swg21255572>
http://www-1.ibm.com/support/docview.wss?uid=swg21255572
V9.5: <http://www-1.ibm.com/support/docview.wss?uid=swg21287889>
http://www-1.ibm.com/support/docview.wss?uid=swg21287889
CVE Information:
<http://www.cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5758>
CVE-2007-5758
Disclosure timeline:
11/29/2007 - Initial vendor notification
12/01/2007 - Initial vendor response
04/09/2008 - Coordinated public disclosure
ADDITIONAL INFORMATION
The information has been provided by iDefense Labs.
The original article can be found at:
<http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=689>
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=689
========================================
This bulletin is sent to members of the SecuriTeam mailing list.
To unsubscribe from the list, send mail with an empty subject line and body to:
list-unsubscribe@securiteam.com
In order to subscribe to the mailing list, simply forward this email to:
list-subscribe@securiteam.com
====================
====================
DISCLAIMER:
The information in this bulletin is provided "AS IS" without warranty of any
kind.
In no event shall we be liable for any damages whatsoever including direct,
indirect, incidental, consequential, loss of business profits or special
damages.
