IBM Issues Patch for DB2 Security Flaw

A software security expert says a DB2 vulnerability could give a low-privilege user full control of the database.

IBM Corp. has issued a patch for a DB2 database vulnerability that, left undetected, could let an intruder compromise administration privileges for DB2 8.1 Enterprise Edition on Microsoft Windows.

To exploit the DB2 flaw, all that is required by a perpetrator is a user ID and password. Through a guest account, an attacker could run commands as an administrator because the Remote Command Server does not drop privileges, said David Litchfield, managing director at London-based Next Generation Security Software Ltd.

According to Litchfield, the Remote Command Server listens on a named pipe, where a small "conversation" takes place when a user connects and sends commands down the pipe. DB2 will then execute that command upon request.

Officials of Armonk, N.Y.-based IBM said no DB2 users have been affected by the vulnerability. Litchfield, however, said the threat to an organization is very real and should be properly addressed.

IBM has included a fix for the DB2 8.1 Enterprise Edition problem in Fixpak 5 at its DB2 technical support Web site.

The vulnerability can be exploited by "a low-privilege user, even if they dont have access to DB2," Litchfield said. "If they have a Windows account, then they can completely own the database server and its data, which to me makes it a high vulnerability," said Litchfield.

The flaw was first discovered by the U.K. security firm in September 2003 during a security audit on behalf of a customer running DB2 software.

Check out eWEEK.coms Database Center at http://database.eweek.com for more database news, views and analysis. Be sure to add our eWEEK.com database news feed to your RSS newsreader:
http://rssnewsapps.ziffdavis.com/eweekdatabase.xml