CVE-2008-1966 : Multiple buffer overflows in the JAR file administration routines in the BSU JAV

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service (instance crash) via a call to the (1) RECOVERJAR or (2) REMOVE_JAR procedure with a crafted parameter, related to (a) sqlj.install_jar and (b) sqlj.replace_jar.

Published 2008-04-27 18:05:00

Updated 2018-10-11 20:38:34

Source MITRE

View at NVD, CVE.org

Vulnerability category: OverflowDenial of service

Products affected by CVE-2008-1966

IBM » DB2 » Version: 8.0
cpe:2.3:a:ibm:db2:8.0:*:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update FP8
cpe:2.3:a:ibm:db2:8.0:fp8:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp13
cpe:2.3:a:ibm:db2:8.0:fp13:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 9.1 Update FP1
cpe:2.3:a:ibm:db2:9.1:fp1:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update FP9
cpe:2.3:a:ibm:db2:8.0:fp9:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp14
cpe:2.3:a:ibm:db2:8.0:fp14:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 9.1
cpe:2.3:a:ibm:db2:9.1:*:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 9.1 Update FP2
cpe:2.3:a:ibm:db2:9.1:fp2:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 9.1 Update Fp2a
cpe:2.3:a:ibm:db2:9.1:fp2a:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 9.1 Update FP3
cpe:2.3:a:ibm:db2:9.1:fp3:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 9.1 Update Fp3a
cpe:2.3:a:ibm:db2:9.1:fp3a:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 9.1 Update FP4
cpe:2.3:a:ibm:db2:9.1:fp4:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 9.5
cpe:2.3:a:ibm:db2:9.5:*:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp4a
cpe:2.3:a:ibm:db2:8.0:fp4a:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update FP5
cpe:2.3:a:ibm:db2:8.0:fp5:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp7b
cpe:2.3:a:ibm:db2:8.0:fp7b:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update FP1
cpe:2.3:a:ibm:db2:8.0:fp1:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp6b
cpe:2.3:a:ibm:db2:8.0:fp6b:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp6c
cpe:2.3:a:ibm:db2:8.0:fp6c:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp9a
cpe:2.3:a:ibm:db2:8.0:fp9a:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp10
cpe:2.3:a:ibm:db2:8.0:fp10:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update FP2
cpe:2.3:a:ibm:db2:8.0:fp2:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update FP3
cpe:2.3:a:ibm:db2:8.0:fp3:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update FP4
cpe:2.3:a:ibm:db2:8.0:fp4:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update FP7
cpe:2.3:a:ibm:db2:8.0:fp7:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp7a
cpe:2.3:a:ibm:db2:8.0:fp7a:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp11
cpe:2.3:a:ibm:db2:8.0:fp11:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp12
cpe:2.3:a:ibm:db2:8.0:fp12:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update FP6
cpe:2.3:a:ibm:db2:8.0:fp6:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp6a
cpe:2.3:a:ibm:db2:8.0:fp6a:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp8a
cpe:2.3:a:ibm:db2:8.0:fp8a:*:*:*:*:*:*
Matching versions
IBM » DB2 » Version: 8.0 Update Fp15
cpe:2.3:a:ibm:db2:8.0:fp15:*:*:*:*:*:*
Matching versions

Threat overview for CVE-2008-1966

Top countries where our scanners detected CVE-2008-1966

Top open port discovered on systems with this issue 523

IPs affected by CVE-2008-1966 17

Threat actors abusing to this issue? Yes

Find out if you^* are affected by CVE-2008-1966!

^*Directly or indirectly through your vendors, service providers and 3rd parties. Powered by attack surface intelligence from SecurityScorecard.

Exploit prediction scoring system (EPSS) score for CVE-2008-1966

EPSS FAQ

1.65%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 87 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2008-1966

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:N/A:P	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2008-1966

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2008-1966