DB2 Version 9.5 Fix Pack 3b for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 2a for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 2  for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 4  for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 3a for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 3 for Linux, UNIX, and Windows
DB2 Version 9.5 Fix Pack 4a for Linux, UNIX, and Windows

APAR status

• Closed as program error.

Error description

• It is possible to use the CLR stored procedure deployment
  feature of the IBM Database add-ins for Visual Studio to
  produce elevation of privilege or denial of service.
  
  This problem was reported to IBM by Martin Rakhmanov of
  Application Security Inc.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Windows
  ****************************************************************
  PROBLEM DESCRIPTION:
  It is possible to use the CLR stored procedure deployment
  feature of IBM Database add-ins for Visual Studio to produce a
  privilege escalation or denial of service on a DB2 server.
  ****************************************************************
  RECOMMENDATION:
  Upgrade to DB2 Version 9.5 Fix Pack 2 and higher
  ****************************************************************
  

Problem conclusion

• Problem was first fixed in DB2 Version 9.5 Fix Pack 2
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DB2 UDB ESE WIN

• Fixed component ID

  5765F4101

Applicable component levels

• R950 PSY

     UP

IBM, the IBM logo and ibm.com are trademarks of International Business Machines Corp., registered in many jurisdictions worldwide. Other product and service names might be trademarks of IBM or other companies. A current list of IBM trademarks is available on the Web at "Copyright and trademark information" at www.ibm.com/legal/copytrade.shtml.

Product categories:

Software

Data Management

Data Servers (Database Management Systems)

DB2 for Linux, UNIX and Windows

Software version:

950

Reference #:

JR28431

IBM Group:

Software Group

Modified date:

2008-08-26