PT-2018-12383 · Ibm · Ibm Db2+2

Published 2018-03-22 · Updated 2019-10-09 · CVE-2018-1427

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

A:H/AC:L/AV:L/C:N/I:N/PR:N/S:U/UI:N

Name of the Vulnerable Software and Affected Versions IBM GSKit (IBM DB2 for Linux, UNIX and Windows) versions 9.7 through 11.1

Description The issue concerns a local denial of service through environment variable overflows and a weakness in the GSKit CMS KDB logic. This logic fails to properly salt the hash function, resulting in weaker protection of passwords, which may allow a weak password to be recovered.

Recommendations For versions 9.7 through 11.1, update to a version that addresses these issues and change passwords to ensure they are stored more securely. As a temporary workaround, consider restricting access to sensitive areas until the update can be applied.

Fix

DoS

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

CVE-2018-1427

Affected Products

Ibm Aix

Ibm Db2

Ibm Gskit

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2018-1427 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/139072 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-1427 · Vendor Advisory
• http://ibm.com/support/docview.wss?uid=swg22013756 · Vendor Advisory
• http://securityfocus.com/bid/103536 · Note
• http://securitytracker.com/id/1041012 · Note