IBM DB2 - Universal Database for Windows NT 6.1/7.1 SQL Denial of Service

Author: benjurry
type: dos
platform: windows
port: 
date_added: 2000-12-05  
date_updated: 2012-08-13  
verified: 1  
codes: CVE-2001-0052;OSVDB-9485  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 20470.txt  
source: https://www.securityfocus.com/bid/2067/info


IBM DB2 Universal Database is a distributed database application.

It may be possible for a database user to crash the server through a bug in handling certain queries. If a certain query is executed that contains a datetime type and varchar type, the server may cease to fucntion requiring a manual reset. The following example was submitted by Benjurry in their advisory:

connect reset;
connect to sample user db2admin using db2admin;
select * from employee where year(birthdate)=1999 and firstnme<'';

It is not known what the cause for this behaviour is. Restarting the application is required in order to regain normal functionality.