PT-2021-3398 · Ibm · Ibm Db2

Dijing Wang · Published 2021-06-24 · Updated 2021-09-20 · CVE-2020-4945

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) version 11.5

Description The issue is related to improper group permissions, allowing an authenticated user to overwrite arbitrary files. This could potentially be exploited by a remote attacker to overwrite files.

Recommendations For IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) version 11.5, consider updating the permissions to prevent arbitrary file overwrites until a patch is available. As a temporary workaround, restrict access to sensitive files and directories to minimize the risk of exploitation.

Fix

Incorrect Permission

Weakness Enumeration

CWE-732

CWE-264

Related Identifiers

BDU:2021-03249

CVE-2020-4945

Affected Products

Ibm Db2

References · 7

• https://bdu.fstec.ru/vul/2021-03249 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/191945 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-4945 · Security Note
• https://ibm.com/support/pages/node/6466367 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-4945 · Vendor Advisory
• https://t.me/cibsecurity/25693 · Telegram Post
• https://security.netapp.com/advisory/ntap-20210720-0006 · Note