IBM DB2 9.5 < Fix Pack 2 Multiple Vulnerabilities

high Nessus Plugin ID 34056

Language:

Synopsis

The remote database server is affected by multiple vulnerabilities.

Description

The installation of IBM DB2 9.5 running on the remote host does not have Fix Pack 2 applied. It is, therefore, affected by the following issues :

- DB2 does not mark inoperative or drop views and triggers if the definer cannot maintain the objects (IZ22307).

- Password-related connection string keyword values may appear in trace output (IZ28489).

- There is an unspecified vulnerability in the way CLR Stored Procedures for Visual Studio from IBM database add-ins are deployed (JR28431).

- There is an unspecified buffer overflow in DAS server code (IZ22190).

- INSTALL_JAR can be used to create or overwrite critical files on a system (IZ22143).

- On Windows, the db2fmp process is running with OS privileges (JR30227).

Solution

Apply IBM DB2 version 9.5 Fix Pack 2.

Plugin Details

Severity: High

ID: 34056

File Name: db2_95fp2.nasl

Version: 1.23

Type: remote

Family: Databases

Published: 8/28/2008

Updated: 4/11/2022

Configuration: Enable thorough checks

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 5.5

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS v3

Risk Factor: High

Base Score: 7.3

Temporal Score: 6.4

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:db2

Exploit Ease: No known exploits are available

Reference Information

CVE: CVE-2008-2154, CVE-2008-3852, CVE-2008-4692, CVE-2008-4693, CVE-2008-6821

BID: 30859, 35408, 35409

CWE: 119, 16, 200, 264

SECUNIA: 31635

Detections

Analytics