Date: Thu, 23 Dec 2004 17:05:53 -0000
From: "NGSSoftware Insight Security Research" <nisr@...tgenss.com>
To: <bugtraq@...urityfocus.com>, <ntbugtraq@...tserv.ntbugtraq.com>,
	<vulnwatch@...nwatch.org>
Subject: IBM DB2 generate_distfile buffer overflow vulnerability (#NISR2122004L)


NGSSoftware Insight Security Research Advisory

Name: IBM DB2 generate_distfile buffer overflow
Systems Affected: DB2 8.1/7.x	
Severity: High risk
Vendor URL: http://www.ibm.com/
Author: David Litchfield [ david at ngssoftware.com ]
Relates to: http://www.nextgenss.com/advisories/db2-01.txt
Date of Public Advisory: 23rd December 2004
Advisory number: #NISR2122004L
Advisory URL: http://www.ngssoftware.com/advisories/db223122004L.txt

Description
***********
IBM's DB2 database server contains a procedure, generate_distfile. This
procedure suffers from a stack based buffer overflow vulnerability.

Details
*******
The generate_distfile procedure is vulnerable to a buffer overflow
vulnerability. generate_distfile is implemented as a C function, exported by
db2dbappext.dll. It takes as its third parameter the name of a file. This
parameter can be up to 255 characters long.

One of the sub functions of generate_distfile takes the third parameter, the
user supplied filename, and appends it to the directory where DB2 has been
installed. It does this by creating a 264 byte buffer on the stack. The
subfunction then calls sqloInstancePath() to get the install path for DB2.
This returns C:\PROGRA~1\IBM\SQLLIB\DB2. \tmp\ is then appended to this.
After \tmp\ is appended the user supplied filename is appended using a while
loop that continues to copy data until a NULL terminator is found. Because
the  DB2 install path (C:\PROGRA~1\IBM\SQLLIB\DB2\tmp\) takes up some of the
buffer, if the user has supplied a thrid parameter of 255 bytes the stack
based  buffer is overflowed.

However, once the buffer is overflowed, as well as overwriting the saved
return address, a pointer is also overwritten. This pointer points to a
buffer where  the resulting full path should be copied to. This interupts a
straight return address overwrite exploit; however it can still easily be
exploited in several  ways. Due to the fact that the attacker "owns" the
pointer to where the path is copied to, they can write arbitrary data to an
arbitrary location allowing a  full compromise. Once such method would be to
overwrite the pointer to the Windows UnhandledExceptionFilter function; as
access violations aren't handled,  the UEF kicks in an as the attacker
controls the UEF the flow of execution can be redirected by the attacker to
arbitrary code.

Note - whilst the discussion has used Windows paths *nix versions of DB2 are
also vulnerable.


Fix Information
***************
IBM has written a patch and can be obtained with the latest fixpak.

http://www-306.ibm.com/software/data/db2/udb/support/downloadv8.html - DB2
v8.1
http://www-306.ibm.com/software/data/db2/udb/support/downloadv7.html - DB2
v7.x

NGSSQuirreL for DB2 (http://www.nextgenss.com/db2.htm) can be used to assess
whether your DB2 server is vulnerable to this.


About NGSSoftware
*****************
NGSSoftware design, research and develop intelligent, advanced application
security assessment scanners. Based in the United Kingdom, NGSSoftware have
offices in the South of London and the East Coast of Scotland. NGSSoftware's
sister company NGSConsulting, offers best of breed security consulting
services, specialising in application, host and network security
assessments.

http://www.ngssoftware.com/

Telephone +44 208 401 0070
Fax +44 208 401 0076

enquiries@...software.com

Powered by blists - more mailing lists