PT-2016-3176 · Ibm · Ibm Db2+1

Publicado 2016-11-30 · Atualizado 2019-10-03 · CVE-2017-1451

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1 IBM DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1

Description The issue is related to insufficient access control in IBM DB2 database management systems, including IBM DB2 Connect Server. This could allow a local user with DB2 instance owner privileges to gain root access.

Recommendations For IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1, consider restricting access to the DB2 instance to minimize the risk of exploitation. For IBM DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1, restrict access to the Connect Server to prevent potential abuse. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

BDU:2017-02179

CVE-2017-1451

Produtos afetados

Ibm Db2

Ibm Db2 Connect Server

Referências · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/128178 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=swg22006061 · Aviso do Fabricante
• http://securitytracker.com/id/1039301 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-1451 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-1451 · Aviso do Fabricante
• http://securityfocus.com/bid/100690 · Nota
• https://bdu.fstec.ru/vul/2017-02179 · Nota de Segurança