Technical Description

Multiple vulnerabilities have been identified in IBM DB2 Universal Database, which could be exploited by local attackers to gain elevated privileges.

The first issue is caused by an error in the "db2dasrrm" utility that creates the "dasRecoveryIndex", "dasRecoveryIndex.tmp", ".dasRecoveryIndex.lock", and "dasRecoveryIndex.cor" with insecure permissions, which could be exploited by the "dasusr1" user or a local attacker (member of the "db2adm1" group) to gain root privileges via symbolic links.

The second vulnerability is caused by a buffer overflow error in the "db2dasrrm" utility when processing the "DASPROF" environment variable, which could be exploited by local attackers to execute arbitrary code with root privileges.

Affected Products

IBM DB2 versions prior to 9.5 Fix Pack 1
IBM DB2 versions prior to 9.1 Fix Pack 4a
IBM DB2 UDB versions prior to 8 FixPak 16

Solution

Upgrade to IBM DB2 version 9.5 Fix Pack 1 :
http://www-1.ibm.com/support/docview.wss?uid=swg21287889

Upgrade to IBM DB2 version 9.1 Fix Pack 4a :
http://www-1.ibm.com/support/docview.wss?uid=swg21255572

Upgrade to IBM DB2 version 8 FixPak 16 :
http://www-1.ibm.com/support/docview.wss?uid=swg21256235

References

http://www.vupen.com/english/advisories/2008/1237
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=688
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=689

Credits

Vulnerabilities reported by Joshua J. Drake and iDefense Labs.

ChangeLog

2008-04-16 : Initial release

Vulnerability Management

Subscribe to VUPEN VNS and receive real-time alerts when new advisories or patches relevant to your systems and network configurations are available.

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.