CVE-2010-3731

IBM DB2 9.1-9.7 - Remote Code Execution via Long Username String

Title source: llm
STIX 2.1

Description

Stack-based buffer overflow in the validateUser implementation in the com.ibm.db2.das.core.DasSysCmd function in db2dasrrm in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP3 allows remote attackers to execute arbitrary code via a long username string.

References (10)

Core 10
Core References
Vendor Advisory third-party-advisory x_refsource_secunia
http://secunia.com/advisories/41686
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/46077
Third Party Advisory, VDB Entry vdb-entry signature x_refsource_oval
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14687
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC70538
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC69986
Various Sources x_refsource_confirm
http://www-01.ibm.com/support/docview.wss?uid=swg21426108
Vendor Advisory vdb-entry x_refsource_vupen
http://www.vupen.com/english/advisories/2010/2544
Various Sources vendor-advisory x_refsource_aixapar
http://www-01.ibm.com/support/docview.wss?uid=swg1IC70539
Third Party Advisory x_refsource_misc
http://www.zerodayinitiative.com/advisories/ZDI-11-035

Scores

EPSS 0.0958
EPSS Percentile 94.9%

Details

CWE
CWE-119
Status published
Products (1)
ibm/db2 9.5 (10 CPE variants)
Published Oct 05, 2010
Tracked Since Feb 18, 2026