IBM DB2 9.1 before FP11, 9.5 before FP9, 9.7 before FP5, and 9.8 before FP4 allows remote attackers to cause a denial of service (daemon crash) via a crafted Distributed Relational Database Architecture (DRDA) request.

According to its version, the installation of IBM DB2 9.1 running on the remote host is prior to Fix Pack 11. It is, therefore, affected by multiple  denial of service vulnerabilities :

  - The version of Java that is bundled with the     application can enter an infinite loop when handling     certain operations related to floating point numbers.
    (CVE-2010-4476)

  - The Distributed Relational Database Architecture (DRDA)     contains an error that can allow denial of service     conditions when handling certain maliciously crafted     requests. (CVE-2012-0710)

Versions of IBM DB2 9.5 earlier than Fix Pack 9 are potentially affected by multiple issues :

 - Incorrect, world-writable file permissions are in place for the file 'NODES.REG'. (IC79518)
 - An unspecified error can allow attacks to cause a denial of service via unspecified vectors. (IC76899)
 - A local user can exploit a vulnerability in the bundled IBM Tivoli Monitoring Agent (ITMA) to escalate their privileges. (IC79970)
 - An unspecified error in the DB2 Administration Server (DAS) can allow remote privilege escalation or denial of service via unspecified vectors. Note that this issue does not affect Windows hosts. (IC80728)
 - An authorized user with 'CONNECT' privileges from 'PUBLIC' can cause a denial of service via unspecified methods related to DB2's XML feature. (IC81379)
 - An authorized user with 'CONNECT' and 'CREATEIN' privileges on a database can perform unauthorized reads on tables. (IC81387)

According to its version, the installation of IBM DB2 9.5 running on the remote host is prior to Fix Pack 9. It is, therefore, affected by the following vulnerabilities :

  - Incorrect, world-writable file permissions are in place     for the file 'NODES.REG'. (IC79518)

  - An unspecified error can allow attacks to cause a     denial of service via unspecified vectors. (IC76899)

  - A local user can exploit a vulnerability in the bundled     IBM Tivoli Monitoring Agent (ITMA) to escalate their     privileges. (IC79970)

  - An unspecified error in the DB2 Administration Server     (DAS) can allow remote privilege escalation or denial     of service via unspecified vectors. Note that this     issue does not affect Windows hosts. (IC80728)

  - An authorized user with 'CONNECT' privileges from     'PUBLIC' can cause a denial of service via unspecified     methods related to DB2's XML feature. (IC81379)

  - An authorized user with 'CONNECT' and 'CREATEIN'     privileges on a database can perform unauthorized     reads on tables. (IC81387)

ID	Name	Product	Family	Type	Severity
59644	IBM DB2 9.1 < Fix Pack 11 Multiple DoS	Nessus	Databases	Remote	medium
6347	IBM DB2 9.5 < 9.5 Fix Pack 9 Multiple Vulnerabilities	Nessus Network Monitor	Database		medium
58293	DB2 9.5 < Fix Pack 9 Multiple Vulnerabilities	Nessus	Databases	Remote	medium

Detections

Analytics

CVE-2012-0710

high

Tenable Plugins

medium

medium

medium