PT-2011-4834 · Ibm · Ibm Db2 Express Edition

Tim Brown · Publicado 2011-10-18 · Atualizado 2018-10-11 · CVE-2011-4061

Positive Technologies (AI Summary)

CVSS v2.0

6.9

Média

Vetor base

AV:L/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 Express Edition 9.7

Description The issue concerns untrusted search path vulnerabilities in the db2rspgn and kbbacf1 components of IBM DB2 Express Edition. This allows local users to gain privileges by utilizing a Trojan horse libkbb.so in the current working directory, related to the DT RPATH ELF header.

Recommendations For IBM DB2 Express Edition 9.7, consider restricting access to the db2rspgn and kbbacf1 components to minimize the risk of exploitation. As a temporary workaround, avoid using these components in untrusted environments until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Identificadores relacionados

CVE-2011-4061

Produtos afetados

Ibm Db2 Express Edition

Referências · 8

• 🔥 http://nth-dimension.org.uk/downloads.php?id=83 · Exploit
• 🔥 http://securityfocus.com/bid/48514 · Exploit
• http://securityfocus.com/bid/51181 · Nota
• http://securityreason.com/securityalert/8476 · Nota
• http://securityfocus.com/archive/1/518659 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14063 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2011-4061 · Nota de Segurança
• http://nth-dimension.org.uk/downloads.php?id=77 · Nota