PT-2020-6086 · Ibm · Db2

Published 2020-06-30 · Updated 2020-07-07 · CVE-2020-4420

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) versions 9.7, 10.1, 10.5, 11.1, and 11.5

Description The issue is related to errors in resource release, which could allow an unauthenticated attacker to cause a denial of service due to a hang in the execution of a terminate command. This can be exploited by a remote attacker.

Recommendations For versions 9.7, 10.1, 10.5, 11.1, and 11.5, consider temporarily restricting access to the terminate command until a patch is available. As a temporary workaround, consider disabling the execution of the terminate command to prevent potential denial of service attacks. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Improper Resource Release

Weakness Enumeration

CWE-404

Related Identifiers

BDU:2021-02974

CVE-2020-4420

Affected Products

Db2

References · 6

• https://ibm.com/support/pages/node/6242362 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-02974 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/180076 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4420 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4420 · Security Note
• https://t.me/cvenotify/4774 · Telegram Post