Description
Stack-based buffer overflow in JDBC Applet Server in IBM DB2 8.1 allows remote attackers to execute arbitrary by connecting and sending a long username, then disconnecting gracefully and reconnecting and sending a short username and an unexpected db2java.zip version, which causes a null terminator to be removed and leads to the overflow.
References
- IY61492 vendor-advisory
- 11401 vdb-entry
- 20050105 IBM DB2 JDBC Applet Server buffer overflow (#NISR05012005D) mailing-list
- 12733 third-party-advisory
- db2-jdbc-bo(17613) vdb-entry
- http://www.nextgenss.com/advisories/db205012005D.txt