PT-2008-3519 · Ibm · Ibm Db2

Cesar Cerrudo · Publicado 2008-04-28 · Atualizado 2018-10-31 · CVE-2008-1998

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 8.0 through 8.0 FP15 IBM DB2 versions 9.1 through 9.1 FP3 IBM DB2 versions 9.5 through 9.5 FP0

Description The issue allows remote authenticated users to overwrite arbitrary files via the log file parameter in the NNSTAT procedure.

Recommendations For IBM DB2 version 8, update to at least FP16 to resolve the issue. For IBM DB2 version 9.1, update to at least FP4a to resolve the issue. For IBM DB2 version 9.5, update to at least FP1 to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2008-1998

Produtos afetados

Ibm Db2

Referências · 11

• https://exchange.xforce.ibmcloud.com/vulnerabilities/41960 · Nota
• http://securityfocus.com/archive/1/491073/100/0/threaded · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06977 · Aviso do Fabricante
• http://securityfocus.com/bid/28836 · Nota
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06976 · Aviso do Fabricante
• http://secunia.com/advisories/29784 · Nota
• http://secunia.com/advisories/29022 · Nota
• http://securityreason.com/securityalert/3840 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-1998 · Nota de Segurança
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ10776 · Aviso do Fabricante
• http://appsecinc.com/resources/alerts/db2/2008-03.shtml · Nota