Two vulnerabilities have been identified in IBM DB2 allowing malicious users to execute arbitrary code.

The problem is that a user, who is able to execute arbitrary SQL queries, may cause a buffer overflow by supplying overly long, specially crafted parameters to the "LOAD" and "INVOKE" commands. This could lead to execution of arbitrary code with the privileges of the DB2 process.

Versions 7.2 and 8.1 have been reported vulnerable on all platforms to the "LOAD" buffer overflow.

Version 7.2 has been reported vulnerable on Windows platforms to the "INVOKE" buffer overflow.

Solution
Apply Fixpak 10 and 10a for version 7.2, and Fixpak 2 for version 8.1.
Further details available to Secunia VIM customers

Provided and/or discovered by
Mark Rowe
Matt Moore

Original Advisory
http://www.pentest.co.uk/documents/ptl-2003-01.htm
http://www.pentest.co.uk/documents/ptl-2003-02.htm

Deep Links
Links available to Secunia VIM customers