PT-2010-5034 · Ibm · Ibm Db2 Udb

Publicado 2010-10-05 · Atualizado 2017-09-19 · CVE-2010-3740

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM DB2 UDB version 9.5 before FP6a

Description The issue is related to the Net Search Extender implementation in the Text Search component, which does not properly handle an alphanumeric Fuzzy search. This allows remote authenticated users to cause a denial of service, resulting in memory consumption and system hang, via the db2ext.textSearch function.

Recommendations For IBM DB2 UDB version 9.5 before FP6a, update to FP6a or later to resolve the issue. As a temporary workaround, consider restricting access to the db2ext.textSearch function to minimize the risk of exploitation.

Correção

DoS

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

CVE-2010-3740

Produtos afetados

Ibm Db2 Udb

Referências · 4

• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13811 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC66613 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2010-3740 · Nota de Segurança
• ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT · Nota