bugtraq - Re: Fwd: vulnerability issue for DB2 express

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: Mon, 18 Nov 2013 19:06:49 GMT
From: shatter@...secinc.com
To: bugtraq@...urityfocus.com
Subject: Re: Fwd: vulnerability issue for DB2 express

This was a bug in the DB2 code and was fixed by IBM long ago.
Both, v6 and v7 of DB2 are very old and out of support versions. Even if you apply the Fix Packs mentioned below you will still have many other security vulnerabilities in the system.
My recommendation is to plan on upgrading the DB2 server to a newer version of DB2 that is still supported by IBM.

For DB2 version 6.1, this was fixed in FixPak 8. You can download this FixPak from 
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us

For DB2 version 7.x, this was fixed in FixPak 3. This FixPak can be downloaded from 
http://www-306.ibm.com/software/data/db2/udb/support/downloadv7.html

You can also find some more information here:
http://www.teamshatter.com/threat-finder/519-ibm-db2-datevarchar-dos/