PT-2009-6559 · Ibm · Ibm Db2

Published 2009-12-28 · Updated 2010-06-29 · CVE-2009-4438

Positive Technologies (AI Summary)

CVSS v2.0

6.5

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP8 IBM DB2 versions 9.5 before FP5 IBM DB2 versions 9.7 before FP1

Description The issue concerns the Query Compiler, Rewrite, and Optimizer component, which fails to enforce privilege requirements for access to sequence or global-variable objects. This allows remote authenticated users to access data via unspecified vectors.

Recommendations For IBM DB2 version 9.1, update to at least FP8 to resolve the issue. For IBM DB2 version 9.5, update to at least FP5 to resolve the issue. For IBM DB2 version 9.7, update to at least FP1 to resolve the issue.

Fix

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2009-4438

Affected Products

Ibm Db2

References · 10

• http://vupen.com/english/advisories/2009/3520 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21412902 · Vendor Advisory
• http://secunia.com/advisories/37759 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC64852 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC62583 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2009-4438 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg21293566 · Patch
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC62543 · Vendor Advisory
• ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT · Note
• http://securityfocus.com/bid/37332 · Note