TITLE:
DB2 Universal Database Multiple Denial of Service Vulnerabilities

SECUNIA ADVISORY ID:
SA17031

VERIFY ADVISORY:
http://secunia.com/advisories/17031/

CRITICAL:
Less critical

IMPACT:
Security Bypass, DoS

WHERE:
>From local network

SOFTWARE:
DB2 Universal Database 8.x
http://secunia.com/product/857/

DESCRIPTION:
Some vulnerabilities have been reported in DB2, which potentially can
be exploited by malicious users to cause a DoS (Denial of Service) or
to bypass certain security restrictions.

1) An error in the handling of SQL query containing constant strings
may be exploited to crash DB2 via a specially crafted query.

2) An infinite loop error in the processing of hash joins may be
exploited to dump error messages into the db2diag.log file,
eventually filling up the file system.

3) An error in the handling of abnormally terminated connections
causes orphaned "db2agents" processes to be left behind and consuming
CPU resources.

4) An error in the handling of object creation may be exploited by
malicious users to create objects based on routines even when the
user is not granted execute privilege.

5) An error in the handling of a query with more than 32000 elements
in the "in" list, or involving the SYSCAT.TABLES, may be exploited to
crash the database instance.

6) An error in the "db2jd" listener service when handling connections
from certain clients may be exploited to crash the service.

SOLUTION:
The vulnerabilities have been fixed in Version 8 FixPak 10 (Version
8.2 FixPak 3)
http://www-1.ibm.com/support/docview.wss?rs=0&uid=swg24010283

PROVIDED AND/OR DISCOVERED BY:
Reported by vendor.

ORIGINAL ADVISORY:
http://www-1.ibm.com/support/docview.wss?uid=swg1IY70808
http://www-1.ibm.com/support/docview.wss?uid=swg1IY70561
http://www-1.ibm.com/support/docview.wss?uid=swg1IY71587
http://www-1.ibm.com/support/docview.wss?uid=swg1IY71865
http://www-1.ibm.com/support/docview.wss?uid=swg1LI70817
http://www-1.ibm.com/support/docview.wss?uid=swg1IY72588
http://www-1.ibm.com/support/docview.wss?uid=swg1JR21329

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------