IBM DB2 Universal Database version 6.1 creates an account with a default user name and password, which allows remote attackers to gain access to the database.

The 'db2admin' account on the remote Windows host uses a known password. This account may have been created during installation of DB2 for use when managing the application, and it likely belongs to the Local Administrators group.

Note that while the DB2 installation no longer uses a default password for this account, the upgrade process does not force a password change if the 'db2admin' account exists from a previous installation.

The account 'db2as' has the password 'db2as'. An attacker may use it to gain further privileges on the system.

The account 'db2as' has the password 'ibmdb2'. An attacker may use it to gain further privileges on the system.

The account 'db2inst1' has the password 'db2inst1'. An attacker may use this to gain further privileges on this system.

The account 'db2fenc1' has the password 'ibmdb2'. An attacker may use this to gain further privileges on this system.

The account 'db2fenc1' has the password 'db2fenc1'. An attacker may use this to gain further privileges on the system.

The account 'db2inst1' has the password 'ibmdb2'.  An attacker may use this to gain further privileges on this system.

ID	Name	Product	Family	Type	Severity
33852	Default Password (db2admin) for 'db2admin' Account on Windows	Nessus	Databases	Local	critical
11864	Default Password (db2as) for 'db2as' Account	Nessus	Default Unix Accounts	Remote	critical
11863	Default Password (ibmdb2) for 'db2as' Account	Nessus	Default Unix Accounts	Remote	critical
11862	Default Password (db2inst) for 'db2inst1' Account	Nessus	Default Unix Accounts	Remote	critical
11861	Default Password (ibmdb2) for 'db2fenc1' Account	Nessus	Default Unix Accounts	Remote	critical
11860	Default Password (db2fenc1) for 'db2fenc1' Account	Nessus	Default Unix Accounts	Remote	critical
11859	Default Password (ibmdb2) for 'db2inst1' Account	Nessus	Default Unix Accounts	Remote	critical

Detections

Analytics

CVE-2001-0051

critical

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical