IC76781: SECURITY: REMOTE DENIAL OF SERVICE OF DB2 SERVER.

DB2 Version 9.1 Fix Pack 11  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 12  for Linux, UNIX and Windows

APAR status

• Closed as program error.

Error description

• A malicious user could remotely, without authentication, exploit
  a denial of service vulnerability in the DB2 server.
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:                                              *
  * All DB2 server systems on all Linux, Unix and Windows        *
  * platforms at service levels from Version 9.1 GA through to   *
  * Version 9.1 Fix Pack 10.                                     *
  ****************************************************************
  * PROBLEM DESCRIPTION:                                         *
  * See Error Description.                                       *
  ****************************************************************
  * RECOMMENDATION:                                              *
  * Upgrade to DB2 Version 9.1 Fix Pack 11.                      *
  ****************************************************************
  

Problem conclusion

• The complete fix for this problem first appears in DB2 Version
  9.1 Fix Pack 11 and all the subsequent Fix Packs.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

  IC76899 IC76900 IC76901 IC76902

Fix information

• Fixed component name

  DB2 FOR LUW

• Fixed component ID

  DB2FORLUW

Applicable component levels

• R910 PSN

     UP