PT-2015-2778 · Ibm · Ibm Db2

Igor · Publicado 2015-07-19 · Atualizado 2017-09-22 · CVE-2015-1883

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Média

Vetor base

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.7 through FP10 IBM DB2 versions 9.8 through FP5 IBM DB2 version 10.1 before FP5 IBM DB2 versions 10.5 through FP5

Description The issue is related to a lack of protection for service data in the database management system. It allows a remote attacker to read administrative files by manipulating the maintenance procedure. This can be achieved through crafted use of an automated-maintenance policy stored procedure.

Recommendations For IBM DB2 versions 9.7 through FP10, update to a version after FP10 to resolve the issue. For IBM DB2 versions 9.8 through FP5, update to a version after FP5 to resolve the issue. For IBM DB2 version 10.1 before FP5, update to FP5 or later to resolve the issue. For IBM DB2 versions 10.5 through FP5, update to a version after FP5 to resolve the issue.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

BDU:2015-12143

CVE-2015-1883

Produtos afetados

Ibm Db2

Referências · 9

• http://securityfocus.com/bid/75946 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-1883 · Nota de Segurança
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT08085 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg21698308 · Aviso do Fabricante
• http://securitytracker.com/id/1032881 · Nota
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT08086 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT08075 · Aviso do Fabricante
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT08080 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2015-12143 · Nota de Segurança