IZ39652: SECURITY: MALICOUS DATA STREAM CAN CAUSE THE DB2 SERVER TO TRAP.

APAR status

• Closed as program error.

Error description

• A malicious, malformed data stream sent to a DB2 server
  can cause the server to trap.  However, the malformed
  data stream is only effective after a valid DB2
  authentication has occurred.  A regular DB2 client can not
  flow the malformed data stream under regular use or
  accidental use.
  .
  This problem was reported to IBM by Dennis Yurichev.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  All DB2 servers on all Linux, Unix and Windows platforms at
  service levels from Version 8.1 GA through to Version 8.1 Fix
  Pack 17.
  ****************************************************************
  PROBLEM DESCRIPTION:
  A malicious, malformed data stream sent to a DB2 server
  can cause the server to trap.  However, the malformed
  data stream is only effective after a valid DB2
  authentication has occurred.  A regular DB2 client can not
  flow the malformed data stream under regular use or
  accidental use.
  .
  This problem was reported to IBM by Dennis Yurichev.
  ****************************************************************
  RECOMMENDATION:
  Upgrade to DB2 Version 8.1 Fix Pack 17a.
  ****************************************************************
  

Problem conclusion

• The complete fix for this problem first appears in DB2 Version
  8.1 Fix Pack 17a and all the subsequent Fix Packs.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IZ39373

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DB2 UDB ESE AIX

• Fixed component ID

  5765F4100

Applicable component levels

• R820 PSN

     UP