CVE-2010-3731: Buffer Overflow

Published Oct 5, 2010

Updated

Stack-based buffer overflow in the validateUser implementation in the com.ibm.db2.das.core.DasSysCmd function in db2dasrrm in the DB2 Administration Server (DAS) component in IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP3 allows remote attackers to execute arbitrary code via a long username string.

Affected Software

10 affected components

IBM DB2=9.5

IBM DB2=9.5-fp4

IBM DB2=9.5-fp5

IBM DB2=9.5-fp4a

IBM DB2=9.5-fp1

IBM DB2=9.5-fp2a

IBM DB2=9.5-fp3b

IBM DB2=9.5-fp2

IBM DB2=9.5-fp3

IBM DB2=9.5-fp3a

Event History

Oct 5, 2010

CVE Published

via MITRE·05:00 PM

Data Sourced

via MITRE·05:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2010-3731?

CVE-2010-3731 has a high severity rating due to its potential to allow remote code execution.

How do I fix CVE-2010-3731?

To fix CVE-2010-3731, install the latest fix pack for IBM DB2 that addresses this vulnerability.

What versions of IBM DB2 are affected by CVE-2010-3731?

CVE-2010-3731 affects IBM DB2 versions 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP3.

Can CVE-2010-3731 be exploited remotely?

Yes, CVE-2010-3731 can be exploited remotely, allowing attackers to execute arbitrary code.

Is there a patch available for CVE-2010-3731?

Yes, IBM has released patches in fix packs that address CVE-2010-3731.