DB2 Version 9.7 Fix Pack 3 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 4 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 5 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 6 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 3a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 7 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 8 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 10 for Linux, UNIX, and Windows

APAR status

• Closed as program error.

Error description

• There exists a buffer overflow vulnerability with the DB2
  Administrative Server (DAS). The vulnerability can cause a trap
  in DAS, causing a denial of service, or can lead to an
  escalation of privileges.
  
  This vulnerability does not affect the DB2 server.
  
  This problem was reported to IBM by an anonymous researcher
  working with TippingPoint's Zero Day Initiative
  (http://www.zerodayinitiative.com)
  

Local fix

• If you are not using DAS, ensure that DAS is not started.
  

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * Users of the DB2 Administrative Server.                      *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to DB2 Version 9.7 Fix Pack 3 or do not start DAS if *
  * DAS is not needed.                                           *
  ****************************************************************
  

Problem conclusion

• The problem was first fixed in DB2 Version 9.7 Fix Pack 3.
  

Temporary fix

• See Local Fix.
  

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IC69986

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DB2 FOR LUW

• Fixed component ID

  DB2FORLUW

Applicable component levels

• R910 PSN

     UP

• R950 PSN

     UP

• R970 PSN

     UP