JR27422: SECURITY: THE PASSWORD USED TO CONNECT TO THE DATABASE CAN BE SEEN IN CLEAR TEXT FROM A MEMORY DUMP.

DB2 Version 9.1 Fix Pack 4a for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 7  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 5   for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 6   for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 6a for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 7a  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 8  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 9  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 10  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 11  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 12  for Linux, UNIX and Windows

APAR status

• Closed as program error.

Error description

• When a memory dump occurs the password used to connect to a
  database remains visible in clear text in memory; even after a
  number of SQL statements have been issued past the database
  connect point and until an application terminates.
  
  The ideal behavior should be that the password is no longer in
  memory as soon as the successful database connection has been
  established.
  

Local fix

Problem summary

• When a memory dump occurs the password used to connect to a
  database remains visible in clear text in memory; even after a
  number of SQL statements have been issued past the database
  connect point and until an application terminates.
  
  The ideal behavior should be that the password is no longer in
  memory as soon as the successful database connection has been
  established.
  

Problem conclusion

• First fixed in DB2 UDB Version 9 Fixpak 5
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

  JR27421

• APAR is sysrouted TO one or more of the following:

  JR28314

Fix information

• Fixed component name

  DB2 UDB ESE WIN

• Fixed component ID

  5765F4101

Applicable component levels

• R810 PSN

     UP

• R820 PSN

     UP

• R950 PSN

     UP