NGSSoftware Insight Security Research Advisory Name: IBM DB2 Windows Permission Problems Systems Affected: DB2 8.1 Severity: High risk from local Vendor URL: http://www.ibm.com/ Author: Chris Anley [ chris at ngssoftware.com ] Relates to: http://www.ngssoftware.com/advisories/db2-02.txt Date of Public Advisory: 5th January 2005 Advisory number: #NISR05012005F Advisory URL: http://www.ngssoftware.com/advisories/db205012005F.txt Description *********** Almost all shared memory sections and events in the Windows version of DB2 have weak permissions; all sections can be read and written by Everyone, and all events can be set and waited on by Everyone. This results in a number of security issues relating to the privileges of local users. Details ******* The numbers below are NGS BUGID reference numbers mentioned in http://www.ngssoftware.com/advisories/db2-02.txt 107) Depending on the server's authentication mode, any user can read plaintext windows usernames and passwords from the 'DB2SHMSECURITYSERVICE' section. If the authentication mode is 'client', the username and password combinations for all client connections can be read from this section. The data in this section persists until another connection is made. 108) Any user can shut down DB2, by setting the event named 'DB2SHUTDOWNSEM'+ pid, for example DB2SHUTDOWNSEM000002ec 109) Any user can DOS the "DB2 Security Server", by writing non-zero values to the section 'DB2SHMSECURITYSERVICE', followed by setting the security service 'input' event, to make the service read the input data: DB2NTSECURITYINPUT The service will then crash. 110) Any user can read potentially sensitive query and/or query result data from a number of shared memory sections. The following sections are marked readable by 'Everybody' section read DB20QM section read DB2GLBQ0QM section read DB2SHMDB2_0APP section read DB2SHMDB2_0APL00000003 section read DB2SHMDB2_0APL00000004 section read DB2SHMDB2_0APL00000005 ...etc 111) After writing to the world-writeable section 'DB20QM': section write DB20QM ... the DB2 'command line processor' will not run, nor will the 'command center', the server has effectively been DOSsed. Fix Information *************** IBM has written a patch and can be obtained with the latest fixpak. http://www-306.ibm.com/software/data/db2/udb/support/downloadv8.html - DB2 v8.1 http://www-306.ibm.com/software/data/db2/udb/support/downloadv7.html - DB2 v7.x NGSSQuirreL for DB2 (http://www.ngssoftware.com/db2.htm) can be used to assess whether your DB2 server is vulnerable to this. About NGSSoftware ***************** NGSSoftware design, research and develop intelligent, advanced application security assessment scanners. Based in the United Kingdom, NGSSoftware have offices in the South of London and the East Coast of Scotland. NGSSoftware's sister company NGSConsulting, offers best of breed security consulting services, specialising in application, host and network security assessments. http://www.ngssoftware.com/ Telephone +44 208 401 0070 Fax +44 208 401 0076 enquiries@private
This archive was generated by hypermail 2.1.3 : Wed Jan 05 2005 - 16:02:03 PST