CVE-2007-6047

Vulnerability

The DB2DART tool in IBM DB2 UDB 9.1 before Fixpak 4 contains an unspecified vulnerability related to the invocation of TPUT by DB2DART. This flaw can be exploited to execute arbitrary commands with the privileges of the DB2 instance owner. The affected versions are IBM DB2 UDB 9.1 prior to Fixpak 4 [1].

Exploitation

An attacker must have the ability to invoke the DB2DART tool, typically requiring some level of local system access or ability to run DB2 commands. The exploitation involves the tool's invocation of TPUT in an unsafe manner, allowing the attacker to supply or influence commands that are then executed as the DB2 instance owner [1].

Impact

Successful exploitation allows the attacker to execute arbitrary commands with the privileges of the DB2 instance owner. This could lead to full compromise of the DB2 instance, including data manipulation, disclosure, or denial of service depending on the attacker's actions [1].

Mitigation

IBM released Fixpak 4 for DB2 Version 9.1 to address this vulnerability. Users should upgrade to DB2 UDB 9.1 Fixpak 4 or later. No workarounds are mentioned in the available references [1].