Fixes are available
DB2 Version 9.1 Fix Pack 7 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 5 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 6 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 6a for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 7a for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 8 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 9 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 10 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 11 for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 12 for Linux, UNIX and Windows
APAR status
Closed as program error.
Error description
It is possible to use the CLR stored procedure deployment feature of IBM Database add-ins for Visual Studio to produce a privilege escalation or denial of service on a DB2 server. This problem was reported to IBM by Martin Rakhmanov of Application Security Inc.
Local fix
Problem summary
**************************************************************** USERS AFFECTED: Windows **************************************************************** PROBLEM DESCRIPTION: It is possible to use the CLR stored procedure deployment feature of IBM Database add-ins for Visual Studio to produce a privilege escalation or denial of service on a DB2 server. **************************************************************** RECOMMENDATION: Upgrade to DB2 V9.1 FP5 and higher ****************************************************************
Problem conclusion
DB2 v9.1 FP5 and higher will contain this fix.
Temporary fix
Comments
APAR Information
APAR number
JR28432
Reported component name
DB2 UDB ESE WIN
Reported component ID
5765F4101
Reported release
910
Status
CLOSED PER
PE
NoPE
HIPER
NoHIPER
Special Attention
NoSpecatt
Submitted date
2008-02-04
Closed date
2008-08-26
Last modified date
2008-08-26
APAR is sysrouted FROM one or more of the following:
APAR is sysrouted TO one or more of the following:
Fix information
Fixed component name
DB2 UDB ESE WIN
Fixed component ID
5765F4101
Applicable component levels
R910 PSY
UP
Document Information
Modified date:
11 October 2021