exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

shatter-clrstored.txt

shatter-clrstored.txt
Posted Sep 16, 2008
Authored by Martin Rakhmanov | Site appsecinc.com

Team SHATTER Security Advisory - It is possible to use the CLR stored procedure deployment feature of IBM Database add-ins for Visual Studio to produce a privilege escalation or denial of service on a DB2 server. IBM DB2 Database Server versions 9.1 and 9.5 on the Windows platform are affected.

tags | advisory, denial of service
systems | windows
advisories | CVE-2008-3852
SHA-256 | 93159e714894796764bdfc5cbc6de85425718a0e10e81c6b0e87ed2a5c4ac87b

shatter-clrstored.txt

Change Mirror Download
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Team SHATTER Security Advisory

*Security Vulnerability in CLR stored procedure deployment from IBM
Database Add-Ins for Visual Studio*

September 15th 2008

Risk Level:
High

Affected versions:
IBM DB2 Database Server v9.1 and 9.5 on Windows platform.

Remote exploitable:
Yes (Authentication to Database Server is needed)

Credits:
This vulnerability was discovered and researched by Martin Rakhmanov
of Application Security Inc.

Details:
It is possible to use the CLR stored procedure deployment feature of
IBM Database add-ins for Visual Studio to produce a privilege
escalation or denial of service on a DB2 server.

Impact:
Any low privileged user can exploit this vulnerability to execute
arbitrary code.

Vendor Status:
Vendor was contacted and a patch was released.

Fix:
To fix the problem apply the FP5(v9.1)and FP2(v9.5):
http://www-01.ibm.com/support/docview.wss?rs=0&uid=swg24019146
http://www-01.ibm.com/support/docview.wss?rs=71&uid=swg21287889

CVE:
CVE-2008-3852

APAR:
JR28432 - V9.1 FP5
JR28431 - V9.5 FP2

Timeline:
Vendor Notification - 9/11/2007
Vendor Response - 11/14/2007
Fix - 8/28/2008
Public Disclosure - 9/15/2008

Application Security, Inc's database security solutions have helped
over 1000 organizations secure their databases from all internal and
external threats while also ensuring that those organizations meet or
exceed regulatory compliance and audit requirements.


Disclaimer: The information in the advisory is believed to be accurate
at the time of publishing based on currently available information.
Use of the information constitutes acceptance for use in an AS IS
condition.
There are no warranties with regard to this information. Neither the
author nor the publisher accepts any liability for any direct,
indirect, or consequential loss or damage arising from use of, or
reliance on, this information.

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.7 (MingW32)
Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org

iD8DBQFI0Axy9EOAcmTuFN0RArrqAKDZbSu5Sf+LgKz/cShXZuhqIRLusgCdFpFx
qNMflaM5L8taBYLDKNjsiUE=
=oC2X
-----END PGP SIGNATURE-----
Login or Register to add favorites

File Archive:

November 2022

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Nov 1st
    16 Files
  • 2
    Nov 2nd
    17 Files
  • 3
    Nov 3rd
    17 Files
  • 4
    Nov 4th
    11 Files
  • 5
    Nov 5th
    0 Files
  • 6
    Nov 6th
    0 Files
  • 7
    Nov 7th
    3 Files
  • 8
    Nov 8th
    59 Files
  • 9
    Nov 9th
    12 Files
  • 10
    Nov 10th
    6 Files
  • 11
    Nov 11th
    11 Files
  • 12
    Nov 12th
    1 Files
  • 13
    Nov 13th
    0 Files
  • 14
    Nov 14th
    9 Files
  • 15
    Nov 15th
    33 Files
  • 16
    Nov 16th
    53 Files
  • 17
    Nov 17th
    11 Files
  • 18
    Nov 18th
    14 Files
  • 19
    Nov 19th
    0 Files
  • 20
    Nov 20th
    0 Files
  • 21
    Nov 21st
    26 Files
  • 22
    Nov 22nd
    22 Files
  • 23
    Nov 23rd
    10 Files
  • 24
    Nov 24th
    9 Files
  • 25
    Nov 25th
    11 Files
  • 26
    Nov 26th
    0 Files
  • 27
    Nov 27th
    0 Files
  • 28
    Nov 28th
    20 Files
  • 29
    Nov 29th
    9 Files
  • 30
    Nov 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Hosting By
Rokasec
close