IBM DB2 - Universal Database for Windows NT 6.1/7.1 SQL Denial of Service

Author: benjurry
type: dos
platform: windows
port: 
date_added: 2000-12-05 
date_updated: 2012-08-13 
verified: 1 
codes: CVE-2001-0052;OSVDB-9485 
tags: 
aliases:  
screenshot_url:  
application_url: 

source: https://www.securityfocus.com/bid/2067/info


IBM DB2 Universal Database is a distributed database application.

It may be possible for a database user to crash the server through a bug in handling certain queries. If a certain query is executed that contains a datetime type and varchar type, the server may cease to fucntion requiring a manual reset. The following example was submitted by Benjurry in their advisory:

connect reset;
connect to sample user db2admin using db2admin;
select * from employee where year(birthdate)=1999 and firstnme<'';

It is not known what the cause for this behaviour is. Restarting the application is required in order to regain normal functionality.