CVE-2006-4257

IBM DB2 Universal Database < 8.1 FixPak 13 - Authenticated Denial of Service via ACCSEC Command or SQLJRA Packet

Title source: llm

Description

IBM DB2 Universal Database (UDB) before 8.1 FixPak 13 allows remote authenticated users to cause a denial of service (crash) by (1) sending the first ACCSEC command without an RDBNAM parameter during the CONNECT process, or (2) sending crafted SQLJRA packet, which results in a null dereference.

References (8)

Core 8

Core References

Vendor Advisory vdb-entry x_refsource_vupen

http://www.vupen.com/english/advisories/2006/3328

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/445298/100/0/threaded

Various Sources vendor-advisory x_refsource_aixapar

ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT

Various Sources x_refsource_misc

http://www.appsecinc.com/resources/alerts/db2/2006-09-05.shtml

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/19586

Patch, Vendor Advisory third-party-advisory x_refsource_secunia

http://secunia.com/advisories/21550

Patch x_refsource_misc

http://www-1.ibm.com/support/docview.wss?uid=swg24013114

Third Party Advisory, VDB Entry mailing-list x_refsource_bugtraq

http://www.securityfocus.com/archive/1/454307/100/0/threaded

Scores

EPSS 0.0213

EPSS Percentile 80.0%

Details

CWE

CWE-399

Status published

Products (11)

ibm/db2 8.0 (3 CPE variants)

ibm/db2 8.1 (5 CPE variants)

ibm/db2 8.1.4 (5 CPE variants)

ibm/db2 8.1.5 (5 CPE variants)

ibm/db2 8.1.6 (5 CPE variants)

ibm/db2 8.1.6c (5 CPE variants)

ibm/db2 8.1.7 (5 CPE variants)

ibm/db2 8.1.7b (5 CPE variants)

ibm/db2 8.1.8 (5 CPE variants)

ibm/db2 8.1.8a (5 CPE variants)

... and 1 more

Published Aug 21, 2006

Tracked Since Feb 18, 2026