PT-2005-5532 · Ibm · Db2

David Litchfield · Publicado 2005-12-31 · Atualizado 2017-07-29 · CVE-2005-4871

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: IBM DB2 version 8.1

Description: The issue allows remote attackers to create or overwrite files via XML functions such as XMLFileFromVarchar or XMLFileFromClob, or read files via XMLVarcharFromFile or XMLClobFromFile, due to certain XML functions running with the privileges of DB2 instead of the logged-in user.

Recommendations: For IBM DB2 version 8.1, consider restricting access to the XML functions XMLFileFromVarchar, XMLFileFromClob, XMLVarcharFromFile, and XMLClobFromFile to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2005-4871

Produtos afetados

Db2

Referências · 6

• http://marc.info/?l=bugtraq&m=110495620513954&w=2 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18761 · Nota
• http://ngssoftware.com/advisories/db205012005I.txt · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2005-4871 · Nota de Segurança
• http://securityfocus.com/bid/12170 · Nota
• http://secunia.com/advisories/12733 · Aviso do Fabricante