Security Issues with IBM DB2 Database
iDenfense security service reports six vulnerabilities in IBM's DB2 database.
The issues were discovered in versions 8 and 9 of IBM's DB2 database solution. The CVE IDs CVE-2007-4276, CVE-2007-4275, CVE-2007-4273, CVE-2007-4272, CVE-2007-4271 and CVE-2007-4270 have been assigned. The first vulnerability triggers a buffer overflow in the database when an attacker specifies a specially crafted string via certain environment variable (issue 4276). The attacker could gain the ability to execute arbitrary code. The second vulnerability (4275) gives attackers the ability to load or run their own binaries when entering a search key.
Another critical error (issue 4273) is cased by vulnerable setuid binaries in DB2. An attacker creating specially crafted symbolic links on the system could trick the system into following the links when creating new directories thus opening the system up to the attacker who would possess full write privileges for the new directories.
The remaining vulnerabilities are all related to faulty file and directory management and could allow attackers to gain root privileges. Details on all vulnerabilities are available from idefense. IBM has responded by releasing fixes to patch the vulnerabilities in both versions of the database (Fix for Version 8, Fix for Version 8).
Issue 263/2022
Buy this issue as a PDF
News
-
Deepin 23 Preview Release is Available For Testing
The developers of Deepin have made a preview release of their latest offering available with three exciting new features.
-
The First Point Release For Ubuntu 22.04 is Now Available
Canonical has released the first point upgrade for Jammy Jellyfish which includes important new toolchains and fixes.
-
Kali Linux 2022.3 Released
From the creators of the most popular penetration testing distributions on the planet, comes a new release with some new tools and a community, real-time chat option.
-
The 14" Pinebook Pro Linux Laptop is Shipping
After a considerable delay, the 14" version of the Pinebook Pro laptop is, once again, available for purchase.
-
OpenMandriva Lx ROME Technical Preview Released
OpenMandriva’s rolling release distribution technical preview has been released for testing purposes and adds some of the latest/greatest software into the mix.
-
Linux Mint 21 is Now Available
The latest iteration of Linux Mint, codenamed Vanessa, has been released with a new upgrade tool and other fantastic features.
-
Firefox Adds Long-Anticipated Feature
Firefox 103 has arrived and it now includes a feature users have long awaited…sort of.
-
System76 Refreshes Their Popular Oryx Pro Laptop with a New CPU
The System76 Oryx Pro laptop has been relaunched with a 12th Gen CPU and more powerful graphics options.
-
Elive Has Released a New Beta
The Elive team is proud to announce the latest beta version (3.8.30) of its Enlightenment-centric Linux distribution.
-
Rocky Linux 9 Has Arrived
The latest iteration of Rocky Linux is now available and includes a host of new features and support for new architecture.