Research Firm Reveals Multiple Flaws in DB2
IBM has patched some flaws in database server software. The company did not specify the exact nature of the problems.Next Generation Security Software Ltd. has announced Multiple High Risk Vulnerabilities in IBM DB2. IBM has released new "Fixpacks" to address two of the issues in DB2 Universal Database for Linux, Unix and Windows Versions 7.x and 8.1. According to NGS, the two issues patched by IBM are remotely exploitable buffer overflows that could allow for complete compromise of the affected database server or denial of service attacks. The NGS report indicates that the security research firm has reported additional bugs to IBM that have not yet been patched.
The IBM patch for DB2 Version 7.x may be found here. The IBM patch for DB2 Version 8.1 may be found here. eWEEK.com could find no specifics of the errors in the bug list provided with the patches, although there was one bug listed as "IY60622 SECURITY VULNERABILITY - POTENTIAL EXPLOITABLE BUFFER OVERFLOW".