----------------------------------------------------------------------

BETA test the new Secunia Personal Software Inspector!

The Secunia PSI detects installed software on your computer and
categorises it as either Insecure, End-of-Life, or Up-To-Date.
Effectively enabling you to focus your attention on software
installations where more secure versions are available from the
vendors.

Download the free PSI BETA from the Secunia website:
https://psi.secunia.com/

----------------------------------------------------------------------

TITLE:
IBM DB2 Multiple Vulnerabilities

SECUNIA ADVISORY ID:
SA26471

VERIFY ADVISORY:
http://secunia.com/advisories/26471/

CRITICAL:
Moderately critical

IMPACT:
Unknown, Security Bypass, Privilege escalation

WHERE:
>From local network

SOFTWARE:
IBM DB2 for Linux UNIX and Windows 9.x
http://secunia.com/product/13504/
DB2 Universal Database 8.x
http://secunia.com/product/857/

DESCRIPTION:
Multiple vulnerabilities have been reported in IBM DB2, some of which
have an unknown impact, while others can potentially be exploited to
bypass certain security restrictions or perform certain actions with
escalated privileges.

1) The problem is that a user may still be able to execute a method
even if the privileges for the method has been revoked.

This vulnerability is reported in version 8.

2) An unspecified error related to incorrect authorization checks has
been reported.

This vulnerability is reported in version 8.

3) An unspecified error exists in AUTH_LIST_GROUPS_FOR_AUTHID within
Base Service Utilities.

This vulnerability is reported in version 9.1.

4) Unspecified errors exists in the db2licm and db2pd tools.

5) Unspecified errors exists in db2licd, and the OSSEMEMDBG and
TRC_LOG_FILE environment variables

6) An unspecified error exists when DB2 "execs" executables while
running as root.

7) DB2 opens certain unspecified files insecurely, which can lead to
symlink attacks.

8) A boundary error when processing the DASPROF environment variable
can be exploited to cause a buffer overflow.

9) An unspecified error exists during instance and FMP startup.

The vulnerabilities are reported in versions 8 and 9.1.

SOLUTION:
DB2 Universal Database 8:
Update to version 8 Fixpak 15.

DB2 Universal Database 9.1
Update to version 9.1 Fixpak 3.

PROVIDED AND/OR DISCOVERED BY:
Reported by the vendor.

ORIGINAL ADVISORY:
IBM:
http://www-1.ibm.com/support/docview.wss?uid=swg1IY88226
http://www-1.ibm.com/support/docview.wss?uid=swg1JR25940
http://www-1.ibm.com/support/docview.wss?uid=swg21255352
http://www-1.ibm.com/support/docview.wss?uid=swg21255607

----------------------------------------------------------------------

About:
This Advisory was delivered by Secunia as a free service to help
everybody keeping their systems up to date against the latest
vulnerabilities.

Subscribe:
http://secunia.com/secunia_security_advisories/

Definitions: (Criticality, Where etc.)
http://secunia.com/about_secunia_advisories/


Please Note:
Secunia recommends that you verify all advisories you receive by
clicking the link.
Secunia NEVER sends attached files with advisories.
Secunia does not advise people to install third party patches, only
use those supplied by the vendor.

----------------------------------------------------------------------