PT-2007-5464 · Ibm · Ibm Db2 Udb

Joshua J. Drake · Published 2007-08-18 · Updated 2017-07-29 · CVE-2007-4272

Positive Technologies (AI Summary)

CVSS v2.0

1.9

Low

Base vector

AV:L/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM DB2 UDB versions 8.0 through 8.0 before Fixpak 15 IBM DB2 UDB versions 9.1 through 9.1 before Fixpak 3

Description The issue allows local users to create arbitrary files via unspecified vectors, including scenarios where an attacker's umask is honored. Additionally, it involves the /etc/ld.so.preload file, certain cron data file locations, and possibly the OSSEMEMDBG or TRC LOG FILE environment variables in db2licd (db2licm).

Recommendations For IBM DB2 UDB versions 8.0 through 8.0 before Fixpak 15, apply Fixpak 15 to resolve the issue. For IBM DB2 UDB versions 9.1 through 9.1 before Fixpak 3, apply Fixpak 3 to resolve the issue. As a temporary workaround, consider restricting access to the db2licd (db2licm) and limiting the ability to modify cron data file locations until a patch is applied.

Fix

Related Identifiers

CVE-2007-4272

Affected Products

Ibm Db2 Udb

References · 13

• http://secunia.com/advisories/26471 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg21255607 · Patch
• http://www-1.ibm.com/support/docview.wss?uid=swg1IY98210 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2007-4272 · Security Note
• http://www-1.ibm.com/support/docview.wss?uid=swg1IY98101 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg21255352 · Patch
• http://www-1.ibm.com/support/docview.wss?uid=swg1IY98011 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/36104 · Note
• http://attrition.org/pipermail/vim/2007-August/001765.html · Note
• http://securityfocus.com/bid/25339 · Note
• http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=580 · Note
• http://securitytracker.com/id?1018581 · Note
• http://vupen.com/english/advisories/2007/2912 · Note