Updates for IBM's DB2 and WebSphere
IBM has released an update for the DB2 database which closes a security hole in the DB2JDS service, through which attackers can execute malicious code on affected systems via the Net. IBM does not mention any details in their security report, however they disclose that an attacker is able to exploit the hole by sending crafted data. Those who are unable to install the update should limit access to the DB2JDS service to trustworthy computers only.
A vulnerability in the Java Message Service (JMS) in IBM's WebSphere application server might also be exploited to cause a denial-of-service attack or to execute injected program code. The vulnerability is attributed to a "double-free", where the software tries to deallocate a previously freed memory reference for the second time. The Fix Pack 19 (6.0.2.19) closes this hole and fixes numerous additional problems. IBM doesn't disclose any specific details here either.
- error report for DB2 from IBM (registration required)
- WebSphere Application Server V6.0.2 Fix Pack 19 for Windows platforms, review from IBM
(mba)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/6/7/2/comingin310_4_kicker-4977194bfb0de0d7.png)
![Kernel Log: Coming in 3.10 (Part 3) [--] Infrastructure](/imgs/43/1/0/4/2/3/2/3/comingin310_3_kicker-151cd7b9e9660f05.png)
