JR28432: SECURITY VULNERABILITY IN CLR STORED PROCEDURE DEPLOYMENT FROM I BM DATABASE ADD-INS FOR VISUAL STUDIO

DB2 Version 9.1 Fix Pack 7  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 5   for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 6   for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 6a for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 7a  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 8  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 9  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 10  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 11  for Linux, UNIX and Windows
DB2 Version 9.1 Fix Pack 12  for Linux, UNIX and Windows

APAR status

• Closed as program error.

Error description

• It is possible to use the CLR stored procedure deployment
  feature of IBM Database add-ins for Visual Studio to produce a
  privilege escalation or denial of service on a DB2 server.
  
  This problem was reported to IBM by Martin Rakhmanov of
  Application Security Inc.
  

Local fix

Problem summary

• ****************************************************************
  USERS AFFECTED:
  Windows
  ****************************************************************
  PROBLEM DESCRIPTION:
  It is possible to use the CLR stored procedure deployment
  feature of IBM Database add-ins for Visual Studio to produce a
  privilege escalation or denial of service on a DB2 server.
  ****************************************************************
  RECOMMENDATION:
  Upgrade to DB2 V9.1 FP5 and higher
  ****************************************************************
  

Problem conclusion

• DB2 v9.1 FP5 and higher will contain this fix.
  

Temporary fix

Comments

APAR Information

• APAR is sysrouted FROM one or more of the following:

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  DB2 UDB ESE WIN

• Fixed component ID

  5765F4101

Applicable component levels

• R910 PSY

     UP