CVE-2003-0898

Description

IBM DB2 7.2 before FixPak 10a, and earlier versions including 7.1, allows local users to overwrite arbitrary files and gain privileges via a symlink attack on (1) db2job and (2) db2job2.

Affected products

• ibm / db2_universal_database8.0
• ibm / db2_universal_database7.1 – 7.1

Exploits & proofs of concept

• exploit-dbIBM DB2 db2job - File Overwriteby Juan Manuel Pascual Escribá

References

• MISCftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/db2aixv7/FP10a_U495172/FixpakReadme.txt
• MAILING_LISThttp://marc.info/?l=bugtraq&m=106010332721672&w=2