PT-2012-4650 · Ibm · Ibm Db2+1

Published 2012-09-25 · Updated 2017-08-29 · CVE-2012-3324

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 and DB2 Connect version 10.1 before FP1

Description A directory traversal issue exists in the UTL FILE module, allowing remote authenticated users to access arbitrary files by manipulating the pathname in the file field. This could lead to modification, deletion, or reading of files outside the intended directory.

Recommendations For IBM DB2 and DB2 Connect version 10.1 before FP1, apply Fix Pack 1 to resolve the issue.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2012-3324

Affected Products

Db2 Connect

Ibm Db2

References · 4

• http://www-01.ibm.com/support/docview.wss?uid=swg21611040 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IC85513 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2012-3324 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/77924 · Note