-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

===========================================================================
AA-2009.0006                  AUSCERT Advisory

                     [Win][Linux][HP-UX][Solaris][AIX]
                    IBM releases new fix packs for DB2
                              22 January 2009
- ---------------------------------------------------------------------------

        AusCERT Advisory Summary
        ------------------------

Product:              IBM DB2
Operating System:     AIX
                      HP-UX
                      Linux variants
                      Solaris
                      Windows
Impact:               Denial of Service
Access:               Existing Account
CVE Names:            CVE-2009-0172 CVE-2009-0173
Member content until: Thursday, February 12 2009

Revision History:     January 22 2009: Added CVEs
                      January 15 2009: Initial Release

OVERVIEW:

       Multiple vulnerabilities have been reported in IBM DB2.


IMPACT:

       The vendor has provided the following information regarding these
       vulnerabilities [1]:

       SECURITY: MALICIOUS CONNECT DATA STREAM CAN CAUSE DENIAL OF SERVICE. 
       SECURITY: MALICOUS DATA STREAM CAN CAUSE THE DB2 SERVER TO TRAP.

       The affected DB2 UDB for Linux, UNIX, and Windows Version 8.1 and 8.2, 
       Version 9.1 and Version 9.5 products are:

         * DB2 Enterprise Server Edition
         * DB2 Workgroup Server (all Editions)
         * DB2 Express Server (all Editions)
         * DB2 Personal Edition
         * DB2 Connect Server (all Editions)


MITIGATION:

       The vendor has release several fix packs to correct these 
       vulnerabilities. Please see the vendor's publication [1] to find a 
       fix pack relevant to your configuration. 


REFERENCES:

       [1] Security and HIPER APARs fixed in DB2 for Linux, UNIX, and Windows 
           Version 9.1 Fix Pack 6a
           http://www-01.ibm.com/support/docview.wss?uid=swg21363936


AusCERT has made every effort to ensure that the information contained
in this document is accurate.  However, the decision to use the information
described is the responsibility of each user or organisation. The decision to
follow or act on information or advice contained in this security bulletin is
the responsibility of each user or organisation, and should be considered in
accordance with your organisation's site policies and procedures. AusCERT
takes no responsibility for consequences which may arise from following or
acting on information or advice contained in this security bulletin.

If you believe that your computer system has been compromised or attacked in 
any way, we encourage you to let us know by completing the secure National IT 
Incident Reporting Form at:

        http://www.auscert.org.au/render.html?it=3192

===========================================================================
Australian Computer Emergency Response Team
The University of Queensland
Brisbane
Qld 4072

Internet Email: auscert@auscert.org.au
Facsimile:      (07) 3365 7031
Telephone:      (07) 3365 4417 (International: +61 7 3365 4417)
                AusCERT personnel answer during Queensland business hours
                which are GMT+10:00 (AEST).
                On call after hours for member emergencies only.
===========================================================================

-----BEGIN PGP SIGNATURE-----
Comment: http://www.auscert.org.au/render.html?it=1967

iQCVAwUBSXfcZCh9+71yA2DNAQJPyQP/cIlCOXorUwytIkXyVcpt0qjhkI9lX2B8
cGk4W+rLaJaqfN6qfqkHJqfNWzh/BxvRhY0vUmQ1bD7bwvi3IFJvCfnVuph44p/Z
nyNsEfp/FHFjU77SHWghCQxIziPQMsIdqfyuUtf+ZJmi2XtPkX4Pj2ElpY8KYnJ2
vOkDkb1/d/4=
=p0cb
-----END PGP SIGNATURE-----