Vulnerability in IBM Db2

CVE-2009-1906

The DRDA Services component in IBM DB2 9.1 before FP7 and 9.5 before FP4 allows remote attackers to cause a denial of service (memory corruption and application crash) via an IPv6 address in the correlation token in the APPID string, as demonstrated by an APPID string sent by the third-party DataDirect JDBC driver 3.7.32.

EPSS: 0.020 (78.4th percentile) — read the EPSS interpretation.

Affected products

  • Ibm Db2 — versions 9.1, 9.5
  • N/a — versions n/a

References

  • cve@mitre.org (vdb-entry, x_refsource_BID)
  • cve@mitre.org (Exploit, vendor-advisory, Patch, Vendor Advisory, x_refsource_AIXAPAR)
  • cve@mitre.org (x_refsource_CONFIRM, Patch)
  • cve@mitre.org (Exploit, vendor-advisory, Patch, Vendor Advisory, x_refsource_AIXAPAR)
  • cve@mitre.org (x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)