IBM DB2 CLR stored procedure deployment unspecified

ibm-db2-clr-unspecified (42927) The risk level is classified as MediumMedium Risk

Description:

An unspecified error in IBM DB2 related to CLR stored procedure deployment from IBM database add-ins for Visual Studio has an unknown impact and attack vector.

Platforms Affected:

  • IBM, DB2 Universal Database 9.1 AIX
  • IBM, DB2 Universal Database 9.1 FP4a Windows
  • IBM, DB2 Universal Database 9.1 Linux
  • IBM, DB2 Universal Database 9.1 Solaris
  • IBM, DB2 Universal Database 9.1 Windows
  • IBM, DB2 Universal Database 9.1 FP2 AIX
  • IBM, DB2 Universal Database 9.1 FP2 HP-UX
  • IBM, DB2 Universal Database 9.1 FP2 Linux
  • IBM, DB2 Universal Database 9.1 FP2 Solaris
  • IBM, DB2 Universal Database 9.1 FP2 Windows
  • IBM, DB2 Universal Database 9.1 FP3 AIX
  • IBM, DB2 Universal Database 9.1 FP3 HP-UX
  • IBM, DB2 Universal Database 9.1 FP3 Linux
  • IBM, DB2 Universal Database 9.1 FP3 Solaris
  • IBM, DB2 Universal Database 9.1 FP3 Windows
  • IBM, DB2 Universal Database 9.1 FP4 AIX
  • IBM, DB2 Universal Database 9.1 FP4 HP-UX
  • IBM, DB2 Universal Database 9.1 FP4 Linux
  • IBM, DB2 Universal Database 9.1 FP4 Solaris
  • IBM, DB2 Universal Database 9.1 FP4 Windows
  • IBM, DB2 Universal Database 9.1 FP4a AIX
  • IBM, DB2 Universal Database 9.1 FP4a HP-UX
  • IBM, DB2 Universal Database 9.1 FP4a Linux
  • IBM, DB2 Universal Database 9.1 FP4a Solaris
  • IBM, DB2 Universal Database 9.1 HP-UX

Remedy:

Apply the patch for this vulnerability (Fix Pack 5), available from the IBM Support & downloads Web site. See References.

Consequences:

Other

References:

  • IBM Support & downloads, IBM - DB2 Version 9.1 for Linux, UNIX and Windows APARs by fix pack at http://www-1.ibm.com/support/docview.wss?uid=swg21255607.
  • BID-29601: IBM DB2 Universal Database Prior to 9.1 Fixpak 5 Multiple Vulnerabilities
  • CVE-2008-3852: Unspecified vulnerability in the CLR stored procedure deployment from IBM Database Add-Ins for Visual Studio in the Visual Studio Net component in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 2 allows remote authenticated users to execute arbitrary code via unknown vectors.
  • SA30558: DB2 Multiple Vulnerabilities
  • SA31635: IBM DB2 CLR Stored Procedures Privilege Escalation and Denial of Service
  • SECTRACK ID: 1020761: IBM DB2 Unspecified CLR Stored Procedures Bug Has Unspecified Impact
  • VUPEN/ADV-2008-1769: IBM DB2 Multiple Buffer Overflow and Security Bypass Vulnerabilities
  • VUPEN/ADV-2008-2445: IBM DB2 CLR Stored Procedures Unspecified Vulnerability

Reported:

Jun 02, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page