PT-2009-6449 · Ibm · Ibm Db2

Publicado 2009-12-16 · Atualizado 2010-06-29 · CVE-2009-4326

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.5 before FP5 IBM DB2 versions 9.7 before FP1

Description The issue is related to the RAND scalar function in the Common Code Infrastructure component. When the Database Partitioning Feature (DPF) is used, it produces repeating return values. This could allow attackers to predict a value and defeat protection mechanisms based on randomization.

Recommendations For IBM DB2 version 9.5, update to FP5 or later to resolve the issue. For IBM DB2 version 9.7, update to FP1 or later to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2009-4326

Produtos afetados

Ibm Db2

Referências · 10

• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ44872 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC63946 · Aviso do Fabricante
• http://vupen.com/english/advisories/2009/3520 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21412902 · Aviso do Fabricante
• http://secunia.com/advisories/37759 · Aviso do Fabricante
• ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4326 · Nota de Segurança
• ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg21293566 · Correção
• http://securityfocus.com/bid/37332 · Nota