IBM DB2 Semaphore Signaling - Denial of Service

QQ空间 新浪微博 微信 QQ facebook twitter
漏洞ID 1054576 漏洞类型
发布时间 2004-09-01 更新时间 2004-09-01
CVE编号 N/A CNNVD-ID N/A
漏洞平台 Windows CVSS评分 N/A
|漏洞来源
https://www.exploit-db.com/exploits/24679
|漏洞详情
漏洞细节尚未披露
|漏洞EXP
source: http://www.securityfocus.com/bid/11403/info

A denial of service vulnerability has been reported in IBM DB2. This vulnerability is reported to only exist when DB2 is installed on Microsoft Windows operating systems. This issue is due to a failure of the application to properly ensure that only authorized users can signal the DB2 UDB instance to shutdown. This is due to a Windows permissions issue related to shared memory sections, culminating in various denial of service attacks.

This vulnerability allows attackers with local access to shutdown the DB2 UDB instance. This will result in the denial of database service to legitimate users.

- Users may set the 'DB2SHUTDOWNSEM' + pid event to shutdown the database. The following example was provided:

DB2SHUTDOWNSEM000002ec

- Non-zero values may be written to the 'DB2SHMSECURITYSERVICE' shared memory section and then read by setting the 'DB2NTSECURITYINPUT' input event.

- Users may write to the 'DB20QM' shared memory section. The following example was provided:

section write DB20QM