PT-2012-3872 · Ibm · Ibm Db2

Publicado 2012-07-25 · Atualizado 2017-12-22 · CVE-2012-2194

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP12 IBM DB2 versions 9.5 through FP9 IBM DB2 versions 9.7 through FP6 IBM DB2 versions 9.8 through FP5 IBM DB2 versions 10.1

Description A directory traversal issue exists in the SQLJ.DB2 INSTALL JAR stored procedure, allowing remote attackers to replace JAR files.

Recommendations For IBM DB2 version 9.1, apply a fix to address the issue. For IBM DB2 version 9.5, update to at least FP10 to resolve the issue. For IBM DB2 version 9.7, update to at least FP7 to resolve the issue. For IBM DB2 version 9.8, update to at least FP6 to resolve the issue. For IBM DB2 version 10.1, update to a newer version to mitigate the risk.

Correção

Path traversal

Enumeração de Fraquezas

CWE-22

Identificadores relacionados

CVE-2012-2194

Produtos afetados

Ibm Db2

Referências · 9

• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84711 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21600837 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84714 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84715 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2012-2194 · Nota de Segurança
• http://securityfocus.com/bid/54487 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84716 · Aviso do Fabricante
• http://secunia.com/advisories/49919 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84019 · Aviso do Fabricante