Stack-based buffer overflow in IBM DB2 - CVE-2017-1297
Published: June 23, 2017 / Updated: September 14, 2018
Vulnerability identifier: #VU7190
CSH Severity: Low
CVSS v4: 9.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H]
CVE-ID: CVE-2017-1297
CWE-ID: CWE-121
Exploitation vector: Local access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a local attacker to gain elevated privileges on the target system.
The weakness exists in IBM DB2 due to stack-based buffer overflow in the Command Line Process (CLP). A local attacker can supply specially crafted data to trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
The weakness exists in IBM DB2 due to stack-based buffer overflow in the Command Line Process (CLP). A local attacker can supply specially crafted data to trigger memory corruption and execute arbitrary code with elevated privileges.
Successful exploitation of the vulnerability may result in system compromise.
Affected software
IBM DB2
How to mitigate CVE-2017-1297
Update to version 11.1.2 FP2; APARs IT20498, IT20570, IT20571.