PT-2012-3872 · Ibm · Ibm Db2

Published 2012-07-25 · Updated 2017-12-22 · CVE-2012-2194

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP12 IBM DB2 versions 9.5 through FP9 IBM DB2 versions 9.7 through FP6 IBM DB2 versions 9.8 through FP5 IBM DB2 versions 10.1

Description A directory traversal issue exists in the SQLJ.DB2 INSTALL JAR stored procedure, allowing remote attackers to replace JAR files.

Recommendations For IBM DB2 version 9.1, apply a fix to address the issue. For IBM DB2 version 9.5, update to at least FP10 to resolve the issue. For IBM DB2 version 9.7, update to at least FP7 to resolve the issue. For IBM DB2 version 9.8, update to at least FP6 to resolve the issue. For IBM DB2 version 10.1, update to a newer version to mitigate the risk.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-2194

Affected Products

Ibm Db2

References · 9

• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84711 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84714 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84715 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-2194 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84716 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC84019 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21600837 · Note
• http://securityfocus.com/bid/54487 · Note
• http://secunia.com/advisories/49919 · Note