PT-2016-3175 · Ibm · Ibm Db2+1

Publicado 2016-11-30 · Atualizado 2019-10-03 · CVE-2017-1452

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1 IBM DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1

Description The issue is related to insufficient access control in IBM DB2 database management systems, including IBM DB2 Connect. It allows a local user to gain elevated privileges and overwrite DB2 files.

Recommendations For IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1, apply the recommended fix from IBM to address the access control issue. For IBM DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1, apply the recommended fix from IBM to address the access control issue. As a temporary workaround, consider restricting access to sensitive DB2 files and directories to minimize the risk of exploitation.

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2017-02178

CVE-2017-1452

Produtos afetados

Ibm Db2

Ibm Db2 Connect Server

Referências · 7

• http://ibm.com/support/docview.wss?uid=swg22006109 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/128180 · Aviso do Fabricante
• http://securitytracker.com/id/1039299 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1452 · Nota de Segurança
• https://bdu.fstec.ru/vul/2017-02178 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1452 · Aviso do Fabricante
• http://securityfocus.com/bid/100698 · Nota