exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Next Generation Security Advisory 223122004L

Next Generation Security Advisory 223122004L
Posted Dec 31, 2004
Authored by David Litchfield, NGSSoftware | Site ngssoftware.com

NGSSoftware Insight Security Research Advisory #NISR2122004L - IBM's DB2 database server contains a procedure, generate_distfile. This procedure suffers from a stack based buffer overflow vulnerability. Systems Affected: DB2 8.1/7.x.

tags | advisory, overflow
SHA-256 | 3ef55a702511cb8221131c88341c2991b45a10ee7c8b153e5ddda2eb0ad3028e

Next Generation Security Advisory 223122004L

Change Mirror Download
NGSSoftware Insight Security Research Advisory

Name: IBM DB2 generate_distfile buffer overflow
Systems Affected: DB2 8.1/7.x
Severity: High risk
Vendor URL: http://www.ibm.com/
Author: David Litchfield [ david at ngssoftware.com ]
Relates to: http://www.nextgenss.com/advisories/db2-01.txt
Date of Public Advisory: 23rd December 2004
Advisory number: #NISR2122004L
Advisory URL: http://www.ngssoftware.com/advisories/db223122004L.txt

IBM's DB2 database server contains a procedure, generate_distfile. This
procedure suffers from a stack based buffer overflow vulnerability.

The generate_distfile procedure is vulnerable to a buffer overflow
vulnerability. generate_distfile is implemented as a C function, exported by
db2dbappext.dll. It takes as its third parameter the name of a file. This
parameter can be up to 255 characters long.

One of the sub functions of generate_distfile takes the third parameter, the
user supplied filename, and appends it to the directory where DB2 has been
installed. It does this by creating a 264 byte buffer on the stack. The
subfunction then calls sqloInstancePath() to get the install path for DB2.
This returns C:\PROGRA~1\IBM\SQLLIB\DB2. \tmp\ is then appended to this.
After \tmp\ is appended the user supplied filename is appended using a while
loop that continues to copy data until a NULL terminator is found. Because
the DB2 install path (C:\PROGRA~1\IBM\SQLLIB\DB2\tmp\) takes up some of the
buffer, if the user has supplied a thrid parameter of 255 bytes the stack
based buffer is overflowed.

However, once the buffer is overflowed, as well as overwriting the saved
return address, a pointer is also overwritten. This pointer points to a
buffer where the resulting full path should be copied to. This interupts a
straight return address overwrite exploit; however it can still easily be
exploited in several ways. Due to the fact that the attacker "owns" the
pointer to where the path is copied to, they can write arbitrary data to an
arbitrary location allowing a full compromise. Once such method would be to
overwrite the pointer to the Windows UnhandledExceptionFilter function; as
access violations aren't handled, the UEF kicks in an as the attacker
controls the UEF the flow of execution can be redirected by the attacker to
arbitrary code.

Note - whilst the discussion has used Windows paths *nix versions of DB2 are
also vulnerable.

Fix Information
IBM has written a patch and can be obtained with the latest fixpak.

http://www-306.ibm.com/software/data/db2/udb/support/downloadv8.html - DB2
http://www-306.ibm.com/software/data/db2/udb/support/downloadv7.html - DB2

NGSSQuirreL for DB2 (http://www.nextgenss.com/db2.htm) can be used to assess
whether your DB2 server is vulnerable to this.

About NGSSoftware
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security


Telephone +44 208 401 0070
Fax +44 208 401 0076


Login or Register to add favorites

File Archive:

September 2023

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Sep 1st
    2 Files
  • 2
    Sep 2nd
    21 Files
  • 3
    Sep 3rd
    0 Files
  • 4
    Sep 4th
    17 Files
  • 5
    Sep 5th
    34 Files
  • 6
    Sep 6th
    29 Files
  • 7
    Sep 7th
    11 Files
  • 8
    Sep 8th
    25 Files
  • 9
    Sep 9th
    0 Files
  • 10
    Sep 10th
    0 Files
  • 11
    Sep 11th
    26 Files
  • 12
    Sep 12th
    23 Files
  • 13
    Sep 13th
    17 Files
  • 14
    Sep 14th
    22 Files
  • 15
    Sep 15th
    16 Files
  • 16
    Sep 16th
    0 Files
  • 17
    Sep 17th
    0 Files
  • 18
    Sep 18th
    19 Files
  • 19
    Sep 19th
    60 Files
  • 20
    Sep 20th
    23 Files
  • 21
    Sep 21st
    15 Files
  • 22
    Sep 22nd
    0 Files
  • 23
    Sep 23rd
    0 Files
  • 24
    Sep 24th
    0 Files
  • 25
    Sep 25th
    0 Files
  • 26
    Sep 26th
    0 Files
  • 27
    Sep 27th
    0 Files
  • 28
    Sep 28th
    0 Files
  • 29
    Sep 29th
    0 Files
  • 30
    Sep 30th
    0 Files

Top Authors In Last 30 Days

File Tags


packet storm

© 2022 Packet Storm. All rights reserved.

Security Services
Hosting By