CVE-2024-49350
📋 TL;DR
IBM Db2 databases running vulnerable versions can be crashed by sending specially crafted queries, causing denial of service. This affects Db2 11.1.0-11.1.4.7, 11.5.0-11.5.9, and 12.1.0-12.1.1 on Linux, UNIX, and Windows systems, including DB2 Connect Server installations.
💻 Affected Systems
- IBM Db2 for Linux, UNIX and Windows
- DB2 Connect Server
📦 What is this software?
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
Db2 by Ibm
⚠️ Risk & Real-World Impact
Worst Case
Complete database unavailability leading to business disruption, data inaccessibility, and potential cascading failures in dependent applications.
Likely Case
Service disruption requiring database restart and temporary unavailability until recovery procedures complete.
If Mitigated
Minimal impact with proper network segmentation, query filtering, and monitoring allowing quick detection and response.
🎯 Exploit Status
Exploitation requires network access to Db2 port and ability to send SQL queries, but no authentication is needed.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apply fixes from IBM: 11.1.4.7a, 11.5.9a, 12.1.1a or later
Vendor Advisory: https://www.ibm.com/support/pages/node/7235069
Restart Required: Yes
Instructions:
1. Download appropriate fix from IBM Fix Central. 2. Stop Db2 services. 3. Apply fix package. 4. Restart Db2 services. 5. Verify version with db2level command.
🔧 Temporary Workarounds
Network Access Restriction
allRestrict network access to Db2 ports (default 50000/50001) to only trusted applications and administrators.
# Use firewall rules to restrict access
iptables -A INPUT -p tcp --dport 50000 -s trusted_ip -j ACCEPT
iptables -A INPUT -p tcp --dport 50000 -j DROP
Query Monitoring and Filtering
allImplement database firewall or monitoring to detect and block suspicious query patterns.
# Configure Db2 audit policies
db2audit configure scope all status both
db2audit start
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Db2 servers from untrusted networks
- Deploy database activity monitoring to detect and alert on exploitation attempts
🔍 How to Verify
Check if Vulnerable:
Check Db2 version with 'db2level' command and compare against affected versions: 11.1.0-11.1.4.7, 11.5.0-11.5.9, 12.1.0-12.1.1Check Version:
db2level | grep 'Product identifier'Verify Fix Applied:
Run 'db2level' command and verify version is 11.1.4.7a, 11.5.9a, 12.1.1a or later📡 Detection & Monitoring
Log Indicators:
- Unexpected database crashes/restarts
- Error logs showing abnormal query termination
- db2diag.log entries indicating segmentation faults or memory errors
Network Indicators:
- Unusual query patterns from single source
- High volume of malformed SQL queries
- Connection attempts followed by service disruption
SIEM Query:
source="db2*" AND ("crash" OR "segmentation fault" OR "abnormal termination")