PT-2008-3519 · Ibm · Ibm Db2

Cesar Cerrudo · Published 2008-04-28 · Updated 2018-10-31 · CVE-2008-1998

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 8.0 through 8.0 FP15 IBM DB2 versions 9.1 through 9.1 FP3 IBM DB2 versions 9.5 through 9.5 FP0

Description The issue allows remote authenticated users to overwrite arbitrary files via the log file parameter in the NNSTAT procedure.

Recommendations For IBM DB2 version 8, update to at least FP16 to resolve the issue. For IBM DB2 version 9.1, update to at least FP4a to resolve the issue. For IBM DB2 version 9.5, update to at least FP1 to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2008-1998

Affected Products

Ibm Db2

References · 11

• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06977 · Vendor Advisory
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ06976 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2008-1998 · Security Note
• http://www-1.ibm.com/support/docview.wss?uid=swg1IZ10776 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41960 · Note
• http://securityfocus.com/archive/1/491073/100/0/threaded · Note
• http://securityfocus.com/bid/28836 · Note
• http://secunia.com/advisories/29784 · Note
• http://secunia.com/advisories/29022 · Note
• http://securityreason.com/securityalert/3840 · Note
• http://appsecinc.com/resources/alerts/db2/2008-03.shtml · Note