Security Issues with IBM DB2 Database
iDenfense security service reports six vulnerabilities in IBM's DB2 database.
The issues were discovered in versions 8 and 9 of IBM's DB2 database solution. The CVE IDs CVE-2007-4276, CVE-2007-4275, CVE-2007-4273, CVE-2007-4272, CVE-2007-4271 and CVE-2007-4270 have been assigned. The first vulnerability triggers a buffer overflow in the database when an attacker specifies a specially crafted string via certain environment variable (issue 4276). The attacker could gain the ability to execute arbitrary code. The second vulnerability (4275) gives attackers the ability to load or run their own binaries when entering a search key.
Another critical error (issue 4273) is cased by vulnerable setuid binaries in DB2. An attacker creating specially crafted symbolic links on the system could trick the system into following the links when creating new directories thus opening the system up to the attacker who would possess full write privileges for the new directories.
The remaining vulnerabilities are all related to faulty file and directory management and could allow attackers to gain root privileges. Details on all vulnerabilities are available from idefense. IBM has responded by releasing fixes to patch the vulnerabilities in both versions of the database (Fix for Version 8, Fix for Version 8).
Subscribe to our Linux Newsletters
Find Linux and Open Source Jobs
Subscribe to our ADMIN Newsletters
Support Our Work
Linux Magazine content is made possible with support from readers like you. Please consider contributing when you’ve found an article to be beneficial.
News
-
EU Sovereign Tech Fund Gains Traction
OpenForum Europe recently released a report regarding a sovereign tech fund with backing from several significant entities.
-
FreeBSD Promises a Full Desktop Installer
FreeBSD has lacked an option to include a full desktop environment during installation.
-
Linux Hits an Important Milestone
If you pay attention to the news in the Linux-sphere, you've probably heard that the open source operating system recently crashed through a ceiling no one thought possible.
-
Plasma Bigscreen Returns
A developer discovered that the Plasma Bigscreen feature had been sitting untouched, so he decided to do something about it.
-
CachyOS Now Lets Users Choose Their Shell
Imagine getting the opportunity to select which shell you want during the installation of your favorite Linux distribution. That's now a thing.
-
Wayland 1.24 Released with Fixes and New Features
Wayland continues to move forward, while X11 slowly vanishes into the shadows, and the latest release includes plenty of improvements.
-
Bugs Found in sudo
Two critical flaws allow users to gain access to root privileges.
-
Fedora Continues 32-Bit Support
In a move that should come as a relief to some portions of the Linux community, Fedora will continue supporting 32-bit architecture.
-
Linux Kernel 6.17 Drops bcachefs
After a clash over some late fixes and disagreements between bcachefs's lead developer and Linus Torvalds, bachefs is out.
-
ONLYOFFICE v9 Embraces AI
Like nearly all office suites on the market (except LibreOffice), ONLYOFFICE has decided to go the AI route.