IBM DB2 admin server privilege escalation

ibm-db2-adminserver-privilege-escalation (42932) The risk level is classified as HighHigh Risk

Description:

An unspecified error in the DB2 Administration Server (DAS) Core DAS function could allow a local attacker to gain root privileges using unknown attack vectors related to file creation.

Platforms Affected:

  • IBM, DB2 Universal Database 9.1 AIX
  • IBM, DB2 Universal Database 9.1 FP4a Windows
  • IBM, DB2 Universal Database 9.1 Linux
  • IBM, DB2 Universal Database 9.1 Solaris
  • IBM, DB2 Universal Database 9.1 Windows
  • IBM, DB2 Universal Database 9.1 FP2 AIX
  • IBM, DB2 Universal Database 9.1 FP2 HP-UX
  • IBM, DB2 Universal Database 9.1 FP2 Linux
  • IBM, DB2 Universal Database 9.1 FP2 Solaris
  • IBM, DB2 Universal Database 9.1 FP2 Windows
  • IBM, DB2 Universal Database 9.1 FP3 AIX
  • IBM, DB2 Universal Database 9.1 FP3 HP-UX
  • IBM, DB2 Universal Database 9.1 FP3 Linux
  • IBM, DB2 Universal Database 9.1 FP3 Solaris
  • IBM, DB2 Universal Database 9.1 FP3 Windows
  • IBM, DB2 Universal Database 9.1 FP4 AIX
  • IBM, DB2 Universal Database 9.1 FP4 HP-UX
  • IBM, DB2 Universal Database 9.1 FP4 Linux
  • IBM, DB2 Universal Database 9.1 FP4 Solaris
  • IBM, DB2 Universal Database 9.1 FP4 Windows
  • IBM, DB2 Universal Database 9.1 FP4a AIX
  • IBM, DB2 Universal Database 9.1 FP4a HP-UX
  • IBM, DB2 Universal Database 9.1 FP4a Linux
  • IBM, DB2 Universal Database 9.1 FP4a Solaris
  • IBM, DB2 Universal Database 9.1 HP-UX

Remedy:

Apply the patch for this vulnerability (Fix Pack 5), available from the IBM Support & downloads Web site. See References.

Consequences:

Gain Privileges

References:

  • IBM Support & downloads, IBM - DB2 Version 9.1 for Linux, UNIX and Windows APARs by fix pack at http://www-1.ibm.com/support/docview.wss?uid=swg21255607.
  • BID-29601: IBM DB2 Universal Database Prior to 9.1 Fixpak 5 Multiple Vulnerabilities
  • CVE-2008-3855: Unspecified vulnerability in the DB2 Administration Server (DAS) in the Core DAS function component in IBM DB2 9.1 before Fixpak 5 allows local users to gain privileges, aka a FILE CREATION VULNERABILITY. NOTE: this may be the same as CVE-2007-5664.
  • SA30558: DB2 Multiple Vulnerabilities
  • VUPEN/ADV-2008-1769: IBM DB2 Multiple Buffer Overflow and Security Bypass Vulnerabilities

Reported:

Jun 02, 2008

The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.

For corrections or additions please email xforce@iss.net

Return to the main page