lists.openwall.net   lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  linux-cve-announce  PHC 
Open Source and information security mailing list archives
 
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Date: Wed, 10 Oct 2007 15:35:42 -0700
From: Joel Jaeggli <joelja@...us.com>
To: zdi-disclosures@...m.com
Cc: full-disclosure@...ts.grok.org.uk, bugtraq@...urityfocus.com
Subject: Re: ZDI-07-056: IBM DB2 DB2JDS Multiple
	Vulnerabilities

So a calendar year goes by between notification and a fix being rolled
out and 3com is proud of this wonderful service they've offered to the
customers of the tipping point product?

Moreover is this considered timely resolution and responsible disclosure?

If I were a customer of either tipping point or IBM's DB2 products I'd
be steamed to have been flying blind for this long protected, not would
be even worse.

zdi-disclosures@...m.com wrote:
> ZDI-07-056: IBM DB2 DB2JDS Multiple Vulnerabilities
> http://www.zerodayinitiative.com/advisories/ZDI-07-056.html
> October 10, 2007
> 
> -- CVE ID:
> CVE-2007-5324
> 
> -- Affected Vendor:
> IBM
> 
> -- Affected Products:
> DB2 Universal Database 8.1
> DB2 Universal Database 8.2
> 
> -- TippingPoint(TM) IPS Customer Protection:
> TippingPoint IPS customers have been protected against this
> vulnerability since January  5, 2007 by Digital Vaccine protection
> filter ID 4870,4876,4877. For further product information on the
> TippingPoint IPS:
> 
>     http://www.tippingpoint.com 
> 
> -- Vulnerability Details:
> The most severe of these vulnerabilities allows remote attackers to
> execute arbitrary code on vulnerable installations of IBM DB2 Universal
> Database. Authentication is not required to exploit these
> vulnerabilities.
> 
> The first flaw exists in the DB2JDS service listening on TCP port 6789.
> A specially crafted packet is improperly processed by an internal
> sprintf() call resulting in a stack overflow which can be leveraged to
> execute arbitrary code.
> 
> Additionally, two DoS condition vulnerabilities were discovered. The
> first flaw is an overflow resulting from an invalid LANG paramater. The
> second DoS can be triggered by sending a packet over 32768 bytes in
> length, resulting in a MemTree overflow which will cause the process to
> terminate.
> 
> -- Vendor Response:
> IBM has issued an update to correct this vulnerability. More details can
> be found at:
> 
> http://www-1.ibm.com/support/docview.wss?uid=swg1IY97750
> 
> -- Disclosure Timeline:
> 2006.11.09 - Vulnerability reported to vendor
> 2007.01.05 - Digital Vaccine released to TippingPoint customers
> 2007.10.10 - Coordinated public release of advisory
> 
> -- Credit:
> This vulnerability was discovered by an anonymous researcher.
> 
> -- About the Zero Day Initiative (ZDI):
> Established by TippingPoint, a division of 3Com, The Zero Day Initiative
> (ZDI) represents a best-of-breed model for rewarding security
> researchers for responsibly disclosing discovered vulnerabilities.
> 
> Researchers interested in getting paid for their security research
> through the ZDI can find more information and sign-up at:
> 
>     http://www.zerodayinitiative.com
> 
> The ZDI is unique in how the acquired vulnerability information is used.
> 3Com does not re-sell the vulnerability details or any exploit code.
> Instead, upon notifying the affected product vendor, 3Com provides its
> customers with zero day protection through its intrusion prevention
> technology. Explicit details regarding the specifics of the
> vulnerability are not exposed to any parties until an official vendor
> patch is publicly available. Furthermore, with the altruistic aim of
> helping to secure a broader user base, 3Com provides this vulnerability
> information confidentially to security vendors (including competitors)
> who have a vulnerability protection or mitigation product.
> 
> 
> CONFIDENTIALITY NOTICE: This e-mail message, including any attachments,
> is being sent by 3Com for the sole use of the intended recipient(s) and
> may contain confidential, proprietary and/or privileged information.
> Any unauthorized review, use, disclosure and/or distribution by any 
> recipient is prohibited.  If you are not the intended recipient, please
> delete and/or destroy all copies of this message regardless of form and
> any included attachments and notify 3Com immediately by contacting the
> sender via reply e-mail or forwarding to 3Com at postmaster@...m.com. 

_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/

Powered by blists - more mailing lists

Powered by Openwall GNU/*/Linux Powered by OpenVZ