PT-2018-12383 · Ibm · Ibm Db2+2

Publicado 2018-03-22 · Atualizado 2019-10-09 · CVE-2018-1427

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Média

Vetor base

A:H/AC:L/AV:L/C:N/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions IBM GSKit (IBM DB2 for Linux, UNIX and Windows) versions 9.7 through 11.1

Description The issue concerns a local denial of service through environment variable overflows and a weakness in the GSKit CMS KDB logic. This logic fails to properly salt the hash function, resulting in weaker protection of passwords, which may allow a weak password to be recovered.

Recommendations For versions 9.7 through 11.1, update to a version that addresses these issues and change passwords to ensure they are stored more securely. As a temporary workaround, consider restricting access to sensitive areas until the update can be applied.

Correção

DoS

Buffer Overflow

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

CVE-2018-1427

Produtos afetados

Ibm Aix

Ibm Db2

Ibm Gskit

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1427 · Nota de Segurança
• http://securityfocus.com/bid/103536 · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/139072 · Aviso do Fabricante
• http://securitytracker.com/id/1041012 · Nota
• https://osv.dev/vulnerability/CVE-2018-1427 · Aviso do Fabricante
• http://ibm.com/support/docview.wss?uid=swg22013756 · Aviso do Fabricante