Memory leak in IBM DB2 gives access to sensitive data, causes DoS

guest · Aug 20, 2020

Memory leak in IBM DB2 gives access to sensitive data, causes DoS
August 20, 2020
https://www.bleepingcomputer.com/ne...b2-gives-access-to-sensitive-data-causes-dos/

A memory leak vulnerability in IBM Db2 relational database could allow an attacker to gain access to sensitive data or cause a denial-of-service (DoS) condition in the database.

The flaw affects IBM Db2 versions for Linux, UNIX, and Windows (9.7, 10.1, 10.5, 11.1, 11.5). It originates from improper usage of shared memory and exploitation is possible by sending a specially crafted request.
Missing access protections
Tracked as CVE-2020-4414, the issue is with the shared memory used by the Db2 trace facility, which lacks explicit protections, allowing read and write access to a local attacker.
Click to expand...

IBM released a patch for the vulnerability on June 30 but the security bulletin provides little information:

“IBM Db2 could allow a local attacker to perform unauthorized actions on the system, caused by improper usage of shared memory. By sending a specially-crafted request, an attacker could exploit this vulnerability to obtain sensitive information or cause a denial of service” - IBM
In a blog post today, Martin Rakhmanov, Security Research Manager, SpiderLabs at Trustwave, details how an attacker could exploit CVE-2020-4414.
He explains that launching a tool, like Process Explorer, that checks for open handles of the Db2 main process, shows that there permissions for accessing the shared memory are missing.
Click to expand...

Log in or Sign up

Memory leak in IBM DB2 gives access to sensitive data, causes DoS

guest Guest

Log in or Sign up

Memory leak in IBM DB2 gives access to sensitive data, causes DoS

guest Guest

Useful Searches