<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN">
<HTML><HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META content="MSHTML 6.00.2900.2963" name=GENERATOR></HEAD>
<BODY>
<DIV><FONT face=Arial size=2>
<P class=MsoTitle style="MARGIN: 12pt 0in 3pt"><SPAN
style="mso-field-code: ' TITLE \* MERGEFORMAT '"><STRONG><FONT size=5>DB2 UDB
- Unauthenticated Buffer Overflow and DoS (BID 18428)</FONT></STRONG></SPAN></P>
<H1 style="MARGIN: 12pt 0in 3pt"><FONT size=5>Background</FONT></H1>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT size=3><FONT
face="Times New Roman"><?xml:namespace prefix = st1 ns =
"urn:schemas-microsoft-com:office:smarttags"
/><st1:PersonName>DB</st1:PersonName>2 Universal Database
(U<st1:PersonName>DB</st1:PersonName>)™ is a popular database software package
from IBM available for legacy platforms as well as open systems (Unix and
Windows). Clients use a protocol called DRDA to communicate
w<st1:PersonName>it</st1:PersonName>h the <st1:PersonName>DB</st1:PersonName>2
U<st1:PersonName>DB</st1:PersonName> server. Protocol messages are used for
session setup, authentication and data transfer<?xml:namespace prefix = o ns =
"urn:schemas-microsoft-com:office:office" /><o:p></o:p></FONT></FONT></P>
<H1 style="MARGIN: 12pt 0in 3pt"><FONT size=5>Scope</FONT></H1>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT size=3><FONT
face="Times New Roman">Imperva’s
<st1:place><st1:PlaceName>Application</st1:PlaceName>
<st1:PlaceName>Defense</st1:PlaceName>
<st1:PlaceType>Center</st1:PlaceType></st1:place> is conducting an extensive
research of the DRDA protocol and <st1:PersonName>it</st1:PersonName>s
implementation. As part of the research the team has identified severe
vulnerability in <st1:PersonName>DB</st1:PersonName>2
U<st1:PersonName>DB</st1:PersonName>’s connection establishment mechanism that
allows an attacker to terminate the U<st1:PersonName>DB</st1:PersonName>
service, effectively denying service from all database
users.<o:p></o:p></FONT></FONT></P>
<H1 style="MARGIN: 12pt 0in 3pt"><FONT size=5>Findings</FONT></H1>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT size=3><FONT
face="Times New Roman">An attacker can send a specially crafted EXCSAT command
during the handshake process with the server, causing the server process to
crash. It seems that the command invokes a buffer overflow condition on the
server possibly allowing execution of arbitrary code on the
server.<o:p></o:p></FONT></FONT></P>
<H1 style="MARGIN: 12pt 0in 3pt"><FONT size=5>Details</FONT></H1>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT face="Times New Roman"
size=3>The first message used by a client when establishing a connection to the
database is the EXCSAT message (message code 0x1041). This message includes an
object called MGRLVLLS (code 0x2114) which in term contains a vector of 4 byte
entries (two bytes for the manager code and two byte for the compatibility
level). When the size of the MGRLVLLS message is large enough a buffer overflow
condition is invoked.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT face="Times New Roman"
size=3>If the client terminates the connection immediately after sending this
message the server process is terminated. </FONT></P>
<H1 style="MARGIN: 12pt 0in 3pt"><FONT size=5>Exploit</FONT></H1>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT size=3><FONT
face="Times New Roman">Create an EXCSAT message with a very long (>1Kbytes)
MGRLVLLS message. (see attached)<o:p></o:p></FONT></FONT></P>
<H1 style="MARGIN: 12pt 0in 3pt"><FONT size=5>Tested Versions</FONT></H1>
<H2 style="MARGIN: 12pt 0in 3pt"><EM>Vulnerable</EM></H2>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT size=3><FONT
face="Times New Roman"><st1:PersonName>DB</st1:PersonName>2
U<st1:PersonName>DB</st1:PersonName> version 8.x all
platforms<o:p></o:p></FONT></FONT></P>
<H2 style="MARGIN: 12pt 0in 3pt"><EM>Not Vulnerable</EM></H2>
<H1 style="MARGIN: 12pt 0in 3pt"><FONT size=5>Vendor’s Status</FONT></H1>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT face="Times New Roman"
size=3>Vendor notified on Feb-8, 2006.</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT face="Times New Roman"
size=3>Vulnerability patched in UDB 8.x FixPak 12 on <st1:date Year="2006"
Day="5" Month="5">May 5<SUP>th</SUP> 2006</st1:date>, APAR is IY84096</FONT></P>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT size=3><FONT
face="Times New Roman">Reported by vendor to Bugtraq on <st1:date Year="2006"
Day="14" Month="6">June 14<SUP>th</SUP> 2006</st1:date> and labeled
<st1:stockticker>BID</st1:stockticker> 18428<o:p></o:p></FONT></FONT></P>
<H1 style="MARGIN: 12pt 0in 3pt"><FONT size=5>Workaround</FONT></H1>
<P class=MsoNormal style="MARGIN: 0in 0in 0pt"><FONT size=3><FONT
face="Times New Roman">None<o:p></o:p></FONT></FONT></P></FONT></DIV>
<DIV> </DIV>
<DIV dir=ltr align=left>
<TABLE cellSpacing=0 cellPadding=0 align=left border=0>
<TBODY>
<TR>
<TD noWrap colSpan=3><FONT face=Verdana color=#2f506d size=2>
<P
style="FONT-SIZE: 11px; COLOR: #2f506d; FONT-FAMILY: Verdana, sans-serif"
align=left><STRONG>Amichai
Shulman</STRONG><BR>CTO<BR><BR></P></FONT></TD></TR>
<TR>
<TD vAlign=top noWrap><FONT face=Verdana color=#2f506d size=2>
<P
style="FONT-SIZE: 11px; COLOR: #2f506d; FONT-FAMILY: Verdana, sans-serif"><A
href="http://www.imperva.com/"><IMG style="MARGIN-BOTTOM: 3px" height=24
alt="Imperva, Inc." src="cid:820353614@06092006-28D7" width=112
border=0></A><BR>12 Hachilazon St.<BR>Ramat Gan<BR>Israel</P>
<P
style="FONT-SIZE: 11px; COLOR: #2f506d; FONT-FAMILY: Verdana, sans-serif">(972)
3-6120133 x103 Office<BR>(972) 54-5885083 Mobile<BR>(972) 3-5711133
Fax<BR><A
href="mailto:shulman@imperva.com">shulman@imperva.com</A></P></FONT></TD>
<TD vAlign=top width=1><IMG height=112
alt=................................ src="cid:820353614@06092006-28DE"
width=41 border=0></TD>
<TD vAlign=top noWrap align=middle><FONT face=Verdana color=#333333
size=2>
<P
style="FONT-SIZE: 11px; COLOR: #333; FONT-FAMILY: Verdana, sans-serif"><A
href="http://imperva.com/go/nc/"><IMG height=40 alt=""
src="cid:820353614@06092006-28E5" width=140 border=0></A>
<BR><BR><STRONG>SecureSphere</STRONG><BR>Named <BR>Editor's Choice
for<BR><SPAN style="COLOR: #d7182a"><STRONG>Web Application
Firewall</STRONG></SPAN><BR><A href="http://imperva.com/go/nc/"><SPAN
style="FONT-SIZE: 10px; COLOR: blue; LINE-HEIGHT: 20px; FONT-FAMILY: Verdana, sans-serif">http://imperva.com/go/nc/</SPAN></A></P></FONT></TD></TR></TBODY></TABLE></DIV>
<DIV> </DIV></BODY></HTML>