IBM Issues Patch for DB2 Security Flaw

By Brian Fonseca  |  Print this article Print


Desktop-as-a-Service Designed for Any Cloud ? Nutanix Frame

A software security expert says a DB2 vulnerability could give a low-privilege user full control of the database.

IBM Corp. has issued a patch for a DB2 database vulnerability that, left undetected, could let an intruder compromise administration privileges for DB2 8.1 Enterprise Edition on Microsoft Windows.

To exploit the DB2 flaw, all that is required by a perpetrator is a user ID and password. Through a guest account, an attacker could run commands as an administrator because the Remote Command Server does not drop privileges, said David Litchfield, managing director at London-based Next Generation Security Software Ltd.

According to Litchfield, the Remote Command Server listens on a named pipe, where a small "conversation" takes place when a user connects and sends commands down the pipe. DB2 will then execute that command upon request.

Officials of Armonk, N.Y.-based IBM said no DB2 users have been affected by the vulnerability. Litchfield, however, said the threat to an organization is very real and should be properly addressed.

IBM has included a fix for the DB2 8.1 Enterprise Edition problem in Fixpak 5 at its DB2 technical support Web site.

Click here for the full story.

Brian Fonseca is a senior writer at eWEEK who covers database, data management and storage management software, as well as storage hardware. He works out of eWEEK's Woburn, Mass., office. Prior to joining eWEEK, Brian spent four years at InfoWorld as the publication's security reporter. He also covered services, and systems management. Before becoming an IT journalist, Brian worked as a beat reporter for The Herald News in Fall River, Mass., and cut his teeth in the news business as a sports and news producer for Channel 12-WPRI/Fox 64-WNAC in Providence, RI. Brian holds a B.A. in Communications from the University of Massachusetts Amherst.

Submit a Comment

Loading Comments...