IZ22188: Buffer overflow condition in DAS server code.

DB2 Version 9.1 Fix Pack 7  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 5   for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 6   for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 6a for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 7a  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 8  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 9  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 10  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 11  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 12  for Linux, UNIX and Windows

APAR status

• Closed as program error.

Error description

• There exists a buffer overflow condition in DAS server code,
  which might lead to DoS, Crash or arbitrary code execution.
  This problem was reported to IBM by Diego Bauche of Application
  Security Inc.
  

Local fix

• No local fix is available.
  

Problem summary

• ****************************************************************
  USERS AFFECTED:
  ALL
  ****************************************************************
  PROBLEM DESCRIPTION:
  There exists a buffer overflow condition in DAS server code,
  which might lead to DoS, Crash or arbitrary code execution.
  This problem was reported to IBM by Diego Bauche of Application
  Security Inc.
  ****************************************************************
  RECOMMENDATION:
  Upgrading to Version 9.1 Fix Pack 5 resolves the issue.
  ****************************************************************
  

Problem conclusion

• Problem was fixed in Version 9.1 Fix Pack 5
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IZ22004

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DB2 UDB ESE AIX

• Fixed component ID

  5765F4100

Applicable component levels

• R910 PSY

     UP