IBM Support

IZ39373: SECURITY: MALICOUS DATA STREAM CAN CAUSE THE DB2 SERVER TO TRAP.

Fixes are available

DB2 Version 9.1 Fix Pack 7  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 6a for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 7a  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 8  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 9  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 10  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 11  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 12  for Linux, UNIX and Windows

Subscribe

You can track all active APARs for this component.

 

APAR status

  • Closed as program error.

Error description

  • A malicious, malformed data stream sent to a DB2 server
can cause the server to trap.  However, the malformed
data stream is only effective after a valid DB2
authentication has occurred.  A regular DB2 client can not
flow the malformed data stream under regular use or
accidental use.
.
This problem was reported to IBM by Dennis Yurichev.

Local fix

  • 



Problem summary


    

  • ****************************************************************
USERS AFFECTED:
All DB2 servers on all Linux, Unix and Windows platforms at
service levels from Version 9.1 GA through to Version 9.1 Fix
Pack 6.
****************************************************************
PROBLEM DESCRIPTION:
A malicious, malformed data stream sent to a DB2 server
can cause the server to trap.  However, the malformed
data stream is only effective after a valid DB2
authentication has occurred.  A regular DB2 client can not
flow the malformed data stream under regular use or
accidental use.
.
This problem was reported to IBM by Dennis Yurichev.
****************************************************************
RECOMMENDATION:
Upgrade to DB2 Version 9.1 Fix Pack 6a.
****************************************************************

    



Problem conclusion


    

  • The complete fix for this problem first appears in DB2 Version
9.1 Fix Pack 6a and all the subsequent Fix Packs.

    



Temporary fix


    

  • 



Comments


    

  • 



APAR Information




    

  • APAR number
    IZ39373
    • 

  • Reported component name
    DB2 UDB ESE AIX
    • 

  • Reported component ID
    5765F4100
    • 

  • Reported release
    910
    • 

  • Status
    CLOSED  PER
    • 

  • PE
    NoPE
    • 

  • HIPER
    NoHIPER
    • 

  • Special Attention
    NoSpecatt
    • 

  • Submitted date
    2008-12-04
    • 

  • Closed date
    2009-02-13
    • 

  • Last modified date
    2009-02-13
    • 





    

  • APAR is sysrouted FROM one or more of the following:
    

    • 

  • APAR is sysrouted TO one or more of the following:
    

    
IZ39652 IZ39653
    

    • 



Fix information


    

  • Fixed component name
    DB2 UDB ESE AIX
    • 

  • Fixed component ID
    5765F4100
    • 



Applicable component levels


    

  • R910  PSN
       UP
    • 








      
              
                            

              

              [{"Line of Business":{"code":"LOB10","label":"Data and AI"},"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SSEPGG","label":"DB2 for Linux- UNIX and Windows"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"910"}]
              

                          

          
 
        

      

    

      

        

          

            
Document Information


            

            


                        

            Modified date:
            

            04 October 2021
            

            
                      

        


        

        


      

    

  



    

  

  
    
            

          
Page Feedback