exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

Next Generation Security Advisory 205012005D

Next Generation Security Advisory 205012005D
Posted Jan 6, 2005
Authored by David Litchfield, NGSSoftware | Site nextgenss.com

NGSSoftware Insight Security Research Advisory #NISR05012005D - IBM's DB2 JDBC Applet Server suffers from a stack based buffer overflow vulnerability that can be exploited remotely without a user ID or password. Systems Affected: DB2 8.1.

tags | advisory, overflow
SHA-256 | f1b0c032caaaca34c6de39e4209280e534786f0ddb5e39bce1e00bd9d05f0ca7

Next Generation Security Advisory 205012005D

Change Mirror Download
NGSSoftware Insight Security Research Advisory

Name: IBM DB2 JDBC Applet Server buffer overflow
Systems Affected: DB2 8.1
Severity: High risk from remote
Vendor URL: http://www.ibm.com/
Author: David Litchfield [ david at ngssoftware.com ]
Relates to: http://www.nextgenss.com/advisories/db2-02.txt
Date of Public Advisory: 5th January 2005
Advisory number: #NISR05012005D
Advisory URL: http://www.ngssoftware.com/advisories/db205012005D.txt

Description
***********
IBM's DB2 JDBC Applet Server suffers from a stack based buffer overflow
vulnerability that can be exploited remotely without a user ID or password.

Details
*******
When a client connects to the JDBC applet server on TCP port 6789 it does so
using a proprietary protocol. The connection packet starts with
ValidDb2jdTokenFromTheClientSide and includes the username, the password,
the db2java.zip version and the database to connect to.

The problem arises as follows.

Firstly, an attacker attempts to authenticate to the JDBC applet server on
TCP 6789 with an overly long username of c. 2200 bytes then disconnects
gracefully.

Secondly, they reconnect, but this time send a short username but set the
db2java.zip version to something other than expected by the server. Set the
version to c. 544 unicode bytes \x00\x41.

An error is logged and at some stage the null terminator is removed and the
original username that was sent is concatentated to the db2java.zip version.

This is then copied to a stack based buffer and it overflows.


Fix Information
***************
IBM has written a patch and can be obtained with the latest fixpak.

http://www-306.ibm.com/software/data/db2/udb/support/downloadv8.html - DB2
v8.1
http://www-306.ibm.com/software/data/db2/udb/support/downloadv7.html - DB2
v7.x

NGSSQuirreL for DB2 (http://www.nextgenss.com/db2.htm) can be used to assess
whether your DB2 server is vulnerable to this.


About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@ngssoftware.com

















Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close