Vulnerability

CERT-In Vulnerability Note CIVN-2014-0289
Denial of Service Vulnerability in IBM DB2

Original Issue Date:December 29, 2014

Severity Rating: MEDIUM

Systems Affected

IBM DB2 Express Edition
IBM DB2 Workgroup Server Edition
IBM DB2 Enterprise Server Edition
IBM DB2 Advanced Enterprise Server Edition
IBM DB2 Advanced Workgroup Server Edition
IBM DB2 Connect Application Server Edition
IBM DB2 Connect Enterprise Edition
IBM DB2 Connect Unlimited Edition for System i�
IBM DB2 Connect Unlimited Edition for System z�
IBM DB2 pureScale Feature for Enterprise Server Edition, V9.8, running on AIX or Linux is affected.

Note: The DB2 Connect products mentioned are affected only if a local database has been created.

Overview

A vulnerability has been reported in IBM DB2 which could allow a remote attacker to conduct denial of service conditions on the target system.

Description

This vulnerability exists in DB2 database products which could be exploited by remote authenticated attacker by sending specially crafted XML query.

Successful exploitation of this vulnerability could cause DB2 to increase CPU usage thereby leading to denial of services condition on the targeted system.

Solution

Apply appropriate patches as mentioned in the IBM Security Bulletin
http://www-01.ibm.com/support/docview.wss?uid=swg21692358

Vendor Information

IBM
http://www-01.ibm.com/support/docview.wss?uid=swg21692358

References

IBM Internet Security Systems
http://xforce.iss.net/xforce/xfdb/99110

Security Focus
http://www.securityfocus.com/bid/71734/info

Security Tracker
http://securitytracker.com/id/1031405

CVE Name
CVE-2014-8901

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-24368572

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India