PT-2017-2969 · Ibm · Ibm Db2+1

Rich Mirch · Published 2017-09-07 · Updated 2019-10-03 · CVE-2017-1439

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1

Description The issue is related to insufficient access control in the IBM DB2 database management system and the IBM DB2 Connect Server, which could allow a local user with DB2 instance owner privileges to obtain root access.

Recommendations For IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

BDU:2017-02294

CVE-2017-1439

Affected Products

Ibm Db2

Ibm Db2 Connect Server

References · 7

• https://bdu.fstec.ru/vul/2017-02294 · Security Note
• http://ibm.com/support/docview.wss?uid=swg22006061 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-1439 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/128058 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-1439 · Vendor Advisory
• http://securitytracker.com/id/1039301 · Note
• http://securityfocus.com/bid/100690 · Note