CVE-2008-3959

Severity: medium (CVSS 5.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 2.2% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2008-09-11 · updated 2026-06-16

Description

IBM DB2 UDB 8.1 before FixPak 16, 8.2 before FixPak 9, and 9.1 before FixPak 4a allows remote attackers to cause a denial of service (instance crash) via a crafted SQLJRA packet within a CONNECT/ATTACH data stream that simulates a V7 client connect/attach request.

Affected products

IBM Db2 for Linux, UNIX and Windows: through 8.1; through 8.2; 8.1-fp1, 8.1-fp10, 8.1-fp11, 8.1-fp12, 8.1-fp13, 8.1-fp14 (+16)

References

http://secunia.com/advisories/29022
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ05043
http://www.appsecinc.com/resources/alerts/db2/2008-01.shtml
https://exchange.xforce.ibmcloud.com/vulnerabilities/45134
http://secunia.com/advisories/29022
http://www-1.ibm.com/support/docview.wss?uid=swg1IZ05043
http://www.appsecinc.com/resources/alerts/db2/2008-01.shtml
https://exchange.xforce.ibmcloud.com/vulnerabilities/45134

Get alerted when CVE-2008-3959 or the next vulnerability affects your stack