IBM Issues Patch for DB2 Security Flaw

By Brian Fonseca  |  Posted 2004-03-10 Print this article Print

A software security expert says a DB2 vulnerability could give a low-privilege user full control of the database.

IBM Corp. has issued a patch for a DB2 database vulnerability that, left undetected, could let an intruder compromise administration privileges for DB2 8.1 Enterprise Edition on Microsoft Windows.

To exploit the DB2 flaw, all that is required by a perpetrator is a user ID and password. Through a guest account, an attacker could run commands as an administrator because the Remote Command Server does not drop privileges, said David Litchfield, managing director at London-based Next Generation Security Software Ltd.

According to Litchfield, the Remote Command Server listens on a named pipe, where a small "conversation" takes place when a user connects and sends commands down the pipe. DB2 will then execute that command upon request.

Officials of Armonk, N.Y.-based IBM said no DB2 users have been affected by the vulnerability. Litchfield, however, said the threat to an organization is very real and should be properly addressed.

IBM has included a fix for the DB2 8.1 Enterprise Edition problem in Fixpak 5 at its DB2 technical support Web site.

The vulnerability can be exploited by "a low-privilege user, even if they dont have access to DB2," Litchfield said. "If they have a Windows account, then they can completely own the database server and its data, which to me makes it a high vulnerability," said Litchfield.

The flaw was first discovered by the U.K. security firm in September 2003 during a security audit on behalf of a customer running DB2 software.

Check out eWEEK.coms Database Center at for more database news, views and analysis. Be sure to add our database news feed to your RSS newsreader:
Brian Fonseca is a senior writer at eWEEK who covers database, data management and storage management software, as well as storage hardware. He works out of eWEEK's Woburn, Mass., office. Prior to joining eWEEK, Brian spent four years at InfoWorld as the publication's security reporter. He also covered services, and systems management. Before becoming an IT journalist, Brian worked as a beat reporter for The Herald News in Fall River, Mass., and cut his teeth in the news business as a sports and news producer for Channel 12-WPRI/Fox 64-WNAC in Providence, RI. Brian holds a B.A. in Communications from the University of Massachusetts Amherst.

Submit a Comment

Loading Comments...
Manage your Newsletters: Login   Register My Newsletters

Rocket Fuel