PT-2008-5904 · Ibm · Ibm Db2

Published 2008-10-22 · Updated 2017-08-08 · CVE-2008-4693

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP6 IBM DB2 versions 9.5 before FP2

Description The issue allows attackers to obtain sensitive information by reading password-related connection string keyword values from the trace output. This is due to the SORT/LIST SERVICES component in IBM DB2 writing sensitive information to the trace output.

Recommendations For IBM DB2 version 9.1, update to at least FP6 to resolve the issue. For IBM DB2 version 9.5, update to at least FP2 to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2008-4693

Affected Products

Ibm Db2

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2008-4693 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ23915 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IZ28489 · Vendor Advisory
• http://vupen.com/english/advisories/2008/2893 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46022 · Note
• http://www-01.ibm.com/support/docview.wss?uid=swg27013892 · Note
• ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT · Note
• http://secunia.com/advisories/32368 · Note