Stack-based buffer overflow in IBM DB2 LUW - CVE-2024-52894

Vulnerability identifier: #VU114126

CSH Severity: Low

CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2024-52894

CWE-ID: CWE-121

Exploitation vector: Remote access

Exploit availability: No public exploit available

The vulnerability allows a remote privileged user to perform a denial of service (DoS) attack.

The vulnerability exists due to application does not properly control consumption of internal resources. A remote privileged user can send a specially crafted query and perform a denial of service (DoS) attack.

IBM DB2 LUW
Watson Query on Cloud Pak for Data
Data Virtualization (DV) on Cloud Pak for Data (CPD)
Db2 Big SQL
IBM OpenPages with Watson
IBM Cloud Pak System
IBM Security Guardium Key Lifecycle Manager (GKLM)
IBM Maximo Application Suite - Manage Component
IBM Security Verify Governance

Install updates from vendor's website.

IBM Cloud Pak System - update to 2.3.6.1
Data Virtualization (DV) on Cloud Pak for Data (CPD) - update to 3.2.1
Db2 Big SQL - update to 8.1
IBM Maximo Application Suite - Manage Component - addressed in versions 8.6.30, 8.7.24, 9.0.17, 9.1.3
IBM OpenPages with Watson - update to 9.1.2

• https://www.ibm.com/support/pages/node/7240953

• Stack-based buffer overflow in IBM Db2 for Linux, UNIX and Windows
• Multiple vulnerabilities in IBM Security Guardium Key Lifecycle Manager
• Multiple vulnerabilities in IBM Data Virtualization on IBM Software Hub
• Multiple vulnerabilities in IBM Security Verify Governance
• Multiple vulnerabilities in IBM OpenPages
• IBM Maximo Application Suite - Manage Component update for IBM Db2 for Linux, UNIX and Windows
• Multiple vulnerabilities in IBM Big SQL on IBM Cloud Pak for Data
• Multiple vulnerabilities in IBM Cloud Pak System