Security Bulletin: IBM Netezza SQL Extensions is vulnerable to an OpenSource PCRE Vulnerability (CVE-2016-1283, CVE-2016-3191)

Summary

Open Source PCRE is used by IBM Netezza SQL Extensions. IBM Netezza SQL Extensions has addressed the applicable CVEs

Vulnerability Details

CVEID: CVE-2016-1283**
DESCRIPTION:** PCRE is vulnerable to a heap-based buffer overflow, caused by the improper handling of patterns by the pcre_compile2() function. By using a specially crafted regular expression, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/109363 for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

CVEID: CVE-2016-3191**
DESCRIPTION:** PCRE and PCRE2 are vulnerable to a stack-based buffer overflow, caused by the improper handling of the (ACCEPT) substring by the compile_branch function in pcre_compile.c. By using a specially-crafted regular expression, a remote attacker could overflow a buffer and execute arbitrary code on the system or cause the application to crash.
CVSS Base Score: 7.3
CVSS Temporal Score: See https://exchange.xforce.ibmcloud.com/vulnerabilities/111583 for the current score
CVSS Environmental Score: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Affected Products and Versions

IBM Netezza SQL Extensions Toolkit 7.2.1.1 (and prior releases)

Remediation/Fixes

IBM Netezza SQL Extensions Toolkit

| 7.2.1.3| https://www-945.ibm.com/support/fixcentral/swg/doSelectFixes?options.selectedFixes=7.2.1.3-IM-Netezza-SQLEXT-fp110503&continue=1
—|—|—

Workarounds and Mitigations

None