PT-2009-6559 · Ibm · Ibm Db2

Publicado 2009-12-28 · Atualizado 2010-06-29 · CVE-2009-4438

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP8 IBM DB2 versions 9.5 before FP5 IBM DB2 versions 9.7 before FP1

Description The issue concerns the Query Compiler, Rewrite, and Optimizer component, which fails to enforce privilege requirements for access to sequence or global-variable objects. This allows remote authenticated users to access data via unspecified vectors.

Recommendations For IBM DB2 version 9.1, update to at least FP8 to resolve the issue. For IBM DB2 version 9.5, update to at least FP5 to resolve the issue. For IBM DB2 version 9.7, update to at least FP1 to resolve the issue.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2009-4438

Produtos afetados

Ibm Db2

Referências · 10

• http://vupen.com/english/advisories/2009/3520 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21412902 · Aviso do Fabricante
• http://secunia.com/advisories/37759 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC64852 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC62583 · Aviso do Fabricante
• ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2009-4438 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg21293566 · Correção
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC62543 · Aviso do Fabricante
• http://securityfocus.com/bid/37332 · Nota