Denial of Service in IBM's DB2 Universal Database

Reported September 18, 2003 by Aaron Newman.

VERSIONS AFFECTED

IBM DB2 Universal Database

DESCRIPTION

A Denial of Service (DoS) condition exists in IBM's DB2 Universal Database. IBM DB2's UDP-based discovery service, listening on port 523, shut downs when it receives more than 20 bytes of data. After the discovery service crashes, the service requires a restart.

VENDOR RESPONSE

IBM has released FixPak 10a to address this vulnerability.

CREDIT

 

Discovered by Application Security Inc.