exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

core.db2.txt

core.db2.txt
Posted Sep 18, 2003
Authored by Juan Pablo Martinez Kuhn | Site coresecurity.com

Core Security Technologies Advisory ID: CORE-2003-0531 - IBM DB2 Universal Data Base v7.2 for Linux/s390 has two binaries in a default install which are setuid to root and have owner and group execute capabilities. These binaries are vulnerable to buffer overflow attacks from a local user that is in the same group.

tags | advisory, overflow, local, root
systems | linux
advisories | CVE-2003-0758, CVE-2003-0759
SHA-256 | 230169f15f23404e9986d75dff6bf3eea592ff6e1d121c14056dd29c97fc181c

core.db2.txt

Change Mirror Download
                        Core Security Technologies Advisory
http://www.coresecurity.com

Multiple IBM DB2 Stack Overflow Vulnerabilities



Date Published: 2003-09-18

Last Update: 2003-09-18

Advisory ID: CORE-2003-0531

Bugtraq ID: 8552, 8553

CVE Name: CAN-2003-0758, CAN-2003-0759

Title: Multiple IBM DB2 Stack Overflow Vulnerabilities

Class: Boundary Error Condition (Buffer Overflow)

Remotely Exploitable: No

Locally Exploitable: Yes

Advisory URL:
http://www.coresecurity.com/common/showdoc.php?idx=366&idxseccion=10

Vendors contacted:
- IBM:
. Core Notification: 2003-08-15
. Notification acknowledged by IBM: 2003-08-18
. Fixes available for [CAN-2003-0758]: 2003-08-31
. Fixes available for [CAN-2003-0759]: 2003-09-17

Release Mode: COORDINATED RELEASE


*Vulnerability Description:*

DB2 is IBM's relational database software, oriented toward the
deployment and development of e-business, business intelligence,
content management, enterprise resource planning and customer
relationship management solutions. DB2 can be deployed in
AIX, HP-UX, Linux, Solaris and Windows environments.

IBM's DB2 database ships with two vulnerable setuid binaries, namely
db2licm and db2dart. Both binaries are vulnerable to a buffer overflow
that allows a local attacker to execute arbitrary code on the
vulnerable machine with privileges of the root user. The vulnerability
is triggered providing a long command line argument to the binaries.

By default (in the environment available during research), the
vulnerable binaries have the following privileges (for example in the
case of db2licm):

-r-sr-x--- 1 root db2iadm1 31926 Jun 21 2002 /home/db2inst1/sqllib/adm/db2licm
-r-sr-x--- 1 root db2asgrp 31926 Jun 21 2002 /home/db2as/sqllib/adm/db2licm

The db2as is the only user of the db2iadm1 group, and db2inst1 is the
only user of the db2asgrp group. So, in a default install, an attacker
with access to the system with any those accounts, will be able to
escalate privileges to the root account.


*Vulnerable Packages:*

IBM DB2 Universal Data Base v7.2 for Linux/x86 is vulnerable.
IBM DB2 Universal Data Base v7.2 for Linux/s390 is vulnerable.

Other IBM DB2 versions and target platforms were not available for
testing, but may be vulnerable as well.


*Solution/Vendor Information/Workaround:*

[BID 8552, CAN-2003-0758]
The db2dart issue is fixed in Fixpak 10 for DB2 v7.2.

Fixpak 10 is available at:
http://www-3.ibm.com/cgi-bin/db2www/data/db2/udb/winos2unix/support/download.d2w/report


[BID 8553, CAN-2003-0759]
The db2licm issue is fixed in Fixpak 10a for DB2 v7.2.

Fixpak 10a will soon be available at:
http://www-3.ibm.com/cgi-bin/db2www/data/db2/udb/winos2unix/support/v7fphist.d2w/report

If Fixpak 10a is not already available in this webpage, you
can download it from IBM's FTP site. For example the 32-bit Intel
Linux version of fixpack 10a is located at:
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2linuxv7/FP10a_U495179



*Credits:*

This vulnerability was found by Juan Pablo Martinez Kuhn from
Core Security Technologies.
We wish to thank Juan Manuel Pascual Escriba for his cooperation
testing and confirming the vulnerabilities. We also wish to thank
Scott Logan from IBM for his quick response to this issue.


*Technical Description - Exploit/Concept Code:*

The following tests are enough to confirm a binary is vulnerable.
Executing these perl scripts should produce a segmentation fault
in vulnerable binaries:

[BID 8552, CAN-2003-0758]

/home/db2as/sqllib/adm/db2dart `perl -e 'print "A"x1287'`

Segmentation fault


[BID 8553, CAN-2003-0759]

/home/db2as/sqllib/adm/db2licm `perl -e 'print "A"x999'`
...
User Response: Enter the name of a file that exists and can be
opened and try the command again.

Segmentation fault
...

Both binaries suffer from a simple stack based buffer overflow.
Exploitation of the vulnerabilities is trivial. To confirm the
exploitability, sample exploit code was developed for DB2 7.1 binaries
for the Linux operating system running on x86 and s390 systems.


*About Core Security Technologies*

Core Security Technologies develops strategic security solutions for
Fortune 1000 corporations, government agencies and military
organizations. The company offers information security software and
services designed to assess risk and protect and manage information
assets.
Headquartered in Boston, MA, Core Security Technologies can be reached
at 617-399-6980 or on the Web at http://www.coresecurity.com.

To learn more about CORE IMPACT, the first comprehensive penetration
testing framework, visit:
http://www.coresecurity.com/products/coreimpact


*DISCLAIMER:*

The contents of this advisory are copyright (c) 2003 CORE Security
Technologies and may be distributed freely provided that no fee is
charged for this distribution and proper credit is given.

$Id: db2-advisory.txt,v 1.4 2003/09/18 11:05:35 carlos Exp $


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close