CVE-2012-0200
Description
The server in IBM solidDB 6.5 before Interim Fix 6 does not properly initialize data structures, which allows remote authenticated users to cause a denial of service (daemon crash) via a SELECT statement with a redundant WHERE condition.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
✚ Propose a mitigation on Community → Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Exploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
IBM solidDB 6.5.0.8 - 'SELECT' Statement 'WHERE' Condition Denial of Service
source: https://www.securityfocus.com/bid/52111/info
IBM solidDB is prone to a denial-of-service vulnerability.
Attackers can exploit this issue to crash the affected application, denying service to legitimate users.
IBM solidDB versions prior to 6.5.0.8 Interim Fix 6 are vulnerable.
SELECT * FROM a WHERE (b >0) AND (b IN (1,2)) References
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC81244
- http://www.ibm.com/support/docview.wss?uid=swg27021052
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73126
- http://www-01.ibm.com/support/docview.wss?uid=swg1IC81244
- http://www.ibm.com/support/docview.wss?uid=swg27021052
- https://exchange.xforce.ibmcloud.com/vulnerabilities/73126
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.