PT-2010-5027 · Ibm · Ibm Db2 Udb

Publicado 2010-10-05 · Atualizado 2017-09-19 · CVE-2010-3733

Positive Technologies (AI Summary)

CVSS v2.0

7.2

Alta

Vetor base

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 UDB version 9.5 before FP6a

Description The issue concerns the Engine Utilities component in IBM DB2 UDB, where the sqllib/cfg/db2sprf file has world-writable permissions. This could potentially allow local users to gain privileges by modifying the file.

Recommendations For IBM DB2 UDB version 9.5 before FP6a, update to FP6a or later to resolve the issue. As a temporary workaround, consider changing the permissions of the sqllib/cfg/db2sprf file to prevent unauthorized modifications.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

CVE-2010-3733

Produtos afetados

Ibm Db2 Udb

Referências · 4

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14707 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-3733 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ68463 · Aviso do Fabricante
• ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT · Nota