CVE-2009-4327: Input Validation

Published Dec 16, 2009

Updated

The Common Code Infrastructure component in IBM DB2 9.5 before FP5 and 9.7 before FP1 does not properly validate the size of a memory pool during a creation attempt, which allows attackers to cause a denial of service (memory consumption) via unspecified vectors.

Affected Software

8 affected components

IBM DB2=9.5

IBM DB2=9.5-fp1

IBM DB2=9.5-fp2a

IBM DB2=9.5-fp3b

IBM DB2=9.5-fp2

IBM DB2=9.7

IBM DB2=9.5-fp3

IBM DB2=9.5-fp3a

Remediation

Patch Available

http://www-01.ibm.com/support/docview.wss?uid=swg21293566

Event History

Dec 16, 2009

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2009-4327?

CVE-2009-4327 is classified as a denial of service vulnerability due to improper memory pool size validation in IBM DB2.

How can I fix CVE-2009-4327?

The recommended fix for CVE-2009-4327 is to upgrade to IBM DB2 version 9.5 FP5 or 9.7 FP1 or later.

What are the affected software versions for CVE-2009-4327?

IBM DB2 versions 9.5 before FP5 and 9.7 before FP1 are affected by CVE-2009-4327.

What type of attack can CVE-2009-4327 enable?

CVE-2009-4327 can enable attackers to cause a denial of service resulting in high memory consumption.

Is there any workaround available for CVE-2009-4327?

There are no specific workarounds mentioned for CVE-2009-4327; upgrading to a patched version is advised.