PT-2016-3176 · Ibm · Ibm Db2+1

Published 2016-11-30 · Updated 2019-10-03 · CVE-2017-1451

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1 IBM DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1

Description The issue is related to insufficient access control in IBM DB2 database management systems, including IBM DB2 Connect Server. This could allow a local user with DB2 instance owner privileges to gain root access.

Recommendations For IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1, consider restricting access to the DB2 instance to minimize the risk of exploitation. For IBM DB2 Connect Server versions 9.7, 10.1, 10.5, and 11.1, restrict access to the Connect Server to prevent potential abuse. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-02179

CVE-2017-1451

Affected Products

Ibm Db2

Ibm Db2 Connect Server

References · 7

• https://exchange.xforce.ibmcloud.com/vulnerabilities/128178 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg22006061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1451 · Security Note
• https://osv.dev/vulnerability/CVE-2017-1451 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02179 · Security Note
• http://securitytracker.com/id/1039301 · Note
• http://securityfocus.com/bid/100690 · Note