PT-2008-5904 · Ibm · Ibm Db2

Publicado 2008-10-22 · Atualizado 2017-08-08 · CVE-2008-4693

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP6 IBM DB2 versions 9.5 before FP2

Description The issue allows attackers to obtain sensitive information by reading password-related connection string keyword values from the trace output. This is due to the SORT/LIST SERVICES component in IBM DB2 writing sensitive information to the trace output.

Recommendations For IBM DB2 version 9.1, update to at least FP6 to resolve the issue. For IBM DB2 version 9.5, update to at least FP2 to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-4693

Produtos afetados

Ibm Db2

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-4693 · Nota de Segurança
• http://vupen.com/english/advisories/2008/2893 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ23915 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46022 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg27013892 · Nota
• ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ28489 · Aviso do Fabricante
• http://secunia.com/advisories/32368 · Nota