According to Litchfield, the Remote Command Server listens on a named pipe, where a small "conversation" takes place when a user connects and sends commands down the pipe. DB2 will then execute that command upon request.

Officials of Armonk, N.Y.-based IBM said no DB2 users have been affected by the vulnerability. Litchfield, however, said the threat to an organization is very real and should be properly addressed.

IBM has included a fix for the DB2 8.1 Enterprise Edition problem in Fixpak 5 at its DB2 technical support Web site.

The vulnerability can be exploited by "a low-privilege user, even if they don't have access to DB2," Litchfield said. "If they have a Windows account, then they can completely own the database server and its data, which to me makes it a high vulnerability," said Litchfield.

Read more