CVE-2007-4276

Related Files

iDEFENSE Security Advisory 2007-08-16.6

Posted Aug 17, 2007

Authored by iDefense Labs | Site idefense.com

iDefense Security Advisory 08.16.07 - Local exploitation of a buffer overflow vulnerability in IBM Corp.'s DB2 Universal Database could allow attackers to elevate privileges to the superuser. This vulnerability specifically exists due to insufficient validation of the length of attacker supplied data. When an attacker specifies a specially crafted string via certain environment variables, the string is copied into a static sized buffer stored on the stack. By supplying too much data, an attacker can overflow the buffer and overwrite stack-stored execution control structures resulting in arbitrary code execution. iDefense confirmed the existence of this vulnerability in version 9.1 Fix Pack 2 of IBM Corp.'s DB2 Universal Database installed on a Linux system. All prior versions, as well as builds for other UNIX-based operating systems, are suspected to be vulnerable.

tags | advisory, overflow, arbitrary, local, code execution

systems | linux, unix

advisories | CVE-2007-4276

SHA-256 | 2ce73c62807c4278c40ffa0601e9af21c2b385048feb81b35475702acd8470ab

Download | Favorite | View