PT-2010-5034 · Ibm · Ibm Db2 Udb

Published 2010-10-05 · Updated 2017-09-19 · CVE-2010-3740

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions IBM DB2 UDB version 9.5 before FP6a

Description The issue is related to the Net Search Extender implementation in the Text Search component, which does not properly handle an alphanumeric Fuzzy search. This allows remote authenticated users to cause a denial of service, resulting in memory consumption and system hang, via the db2ext.textSearch function.

Recommendations For IBM DB2 UDB version 9.5 before FP6a, update to FP6a or later to resolve the issue. As a temporary workaround, consider restricting access to the db2ext.textSearch function to minimize the risk of exploitation.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

CVE-2010-3740

Affected Products

Ibm Db2 Udb

References · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg1IC66613 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2010-3740 · Security Note
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13811 · Note
• ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT · Note