PT-2015-2778 · Ibm · Ibm Db2

Igor · Published 2015-07-19 · Updated 2017-09-22 · CVE-2015-1883

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:N/AC:L/Au:S/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.7 through FP10 IBM DB2 versions 9.8 through FP5 IBM DB2 version 10.1 before FP5 IBM DB2 versions 10.5 through FP5

Description The issue is related to a lack of protection for service data in the database management system. It allows a remote attacker to read administrative files by manipulating the maintenance procedure. This can be achieved through crafted use of an automated-maintenance policy stored procedure.

Recommendations For IBM DB2 versions 9.7 through FP10, update to a version after FP10 to resolve the issue. For IBM DB2 versions 9.8 through FP5, update to a version after FP5 to resolve the issue. For IBM DB2 version 10.1 before FP5, update to FP5 or later to resolve the issue. For IBM DB2 versions 10.5 through FP5, update to a version after FP5 to resolve the issue.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2015-12143

CVE-2015-1883

Affected Products

Ibm Db2

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2015-1883 · Security Note
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT08085 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg21698308 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT08086 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT08075 · Vendor Advisory
• http://www-01.ibm.com/support/docview.wss?uid=swg1IT08080 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-12143 · Security Note
• http://securityfocus.com/bid/75946 · Note
• http://securitytracker.com/id/1032881 · Note