PT-2005-5532 · Ibm · Db2

David Litchfield · Published 2005-12-31 · Updated 2017-07-29 · CVE-2005-4871

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: IBM DB2 version 8.1

Description: The issue allows remote attackers to create or overwrite files via XML functions such as XMLFileFromVarchar or XMLFileFromClob, or read files via XMLVarcharFromFile or XMLClobFromFile, due to certain XML functions running with the privileges of DB2 instead of the logged-in user.

Recommendations: For IBM DB2 version 8.1, consider restricting access to the XML functions XMLFileFromVarchar, XMLFileFromClob, XMLVarcharFromFile, and XMLClobFromFile to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2005-4871

Affected Products

Db2

References · 6

• http://ngssoftware.com/advisories/db205012005I.txt · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2005-4871 · Security Note
• http://secunia.com/advisories/12733 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=110495620513954&w=2 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/18761 · Note
• http://securityfocus.com/bid/12170 · Note