PT-2024-4312 · Ibm · Db2 Connect Server+1

Published 2024-06-12 · Updated 2024-08-07 · CVE-2023-29267

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 10.5, 11.1, and 11.5

Description The issue is related to resource management errors in IBM DB2 and IBM DB2 Connect Server, which can be exploited by a remote attacker using specially crafted SQL statements to cause a denial of service. This can happen under specific configurations, where the server may crash when an authenticated user uses a specially crafted SQL statement.

Recommendations For IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) versions 10.5, 11.1, and 11.5, consider restricting access to the SQL statement functionality to minimize the risk of exploitation until a patch is available. As a temporary workaround, consider disabling the use of specially crafted SQL statements by authenticated users until a fix is provided. Avoid using SQL statements that may cause the server to crash until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

DoS

Weakness Enumeration

CWE-399

Related Identifiers

BDU:2024-04800

CVE-2023-29267

Affected Products

Db2 Connect Server

Ibm Db2

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2023-29267 · Security Note
• https://bdu.fstec.ru/vul/2024-04800 · Security Note
• https://ibm.com/support/pages/node/7156851 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-29267 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/287612 · Note
• https://t.me/cvenotify/83059 · Telegram Post
• https://security.netapp.com/advisory/ntap-20240828-0004 · Note
• https://t.me/cvenotify/89739 · Telegram Post