IBM DB2 < 9 Fix Pack 5 Multiple Vulnerabilities

This script is Copyright (C) 2008-2015 Tenable Network Security, Inc.

Synopsis :

The remote database server is affected by multiple vulnerabilities.

Description :

According to its version, the IBM DB2 server running on the remote
host is affected by one or more of the following issues :

- There is an unspecified security vulnerability
related to a 'DB2FMP' process. (IZ20352)

- On Windows, the 'DB2FMP' process is running with OS
privileges. (JR30026)

- The CLR stored procedure deployment feature of IBM
Database Add-Ins for Visual Studio can be used to
escalate privileges or launch a denial of service
attack against a DB2 server. (JR28432)

- The password used to connect to the database can be
seen in plaintext in a memory dump. (JR27422)

- There is a possible stack variable overrun in
'SQLRLAKA()'. (IZ16346)

- A local privilege escalation vulnerability via file
creation can result in root-level access. (IZ12735)

- There are possible buffer overflows involving 'XQUERY',

- A specially crafted client CONNECT request could
crash the server. (IZ07299)

- There is an unspecified remote buffer overflow in
DAS server code. (IZ22188)

- INSTALL_JAR can be used to create or overwrite
critical system files. (IZ21983)

See also :

Solution :

Apply IBM DB2 Version 9 Fix Pack 5 or later.

Risk factor :

Critical / CVSS Base Score : 10.0
CVSS Temporal Score : 7.4
Public Exploit Available : false

Family: Databases

Nessus Plugin ID: 33128 (db2_9fp5.nasl)

Bugtraq ID: 29601

CVE ID: CVE-2008-2154