Unspecified vulnerability in the XML feature in IBM DB2 9.7 before FP6 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary XML files via unknown vectors.

Versions of IBM DB2 9.8 earlier than Fix Pack 5 are potentially affected by multiple issues :

 - A flaw exists in relational data services that is due to privileges persisting when they're removed from users.  This may allow attackers to execute non-DDL statements after their privileges have been revoked.
 - A flaw exists that is triggered when Self Tuning Memory Manager (STMM) is enabled and DATABASE_MEMORY is set to AUTOMATIC.  This may allow a local attacker to potentially cause a crash.
 - An authorized user with 'CONNECT' privileges from 'PUBLIC' can cause a denial of service via unspecified methods related to DB2's XML feature. (CVE-2012-0712)
 - An unspecified information disclosure vulnerability exists related to the XML feature that can allow improper access to arbitrary XML files. (CVE-2012-0713)
 - An error exists related to the Distributed RelationalDatabase Architecture (DRDA) that can allow denial of service conditions when processing certain request. (CVE-2012-2180)

According to its version, the installation of IBM DB2 9.5 running on the remote host is affected by one or more of the following issues :

  - An unspecified information disclosure error exists     related to the XML feature that can allow improper     access to arbitrary XML files. (#IC81461, CVE-2012-0713)

  - An error exists related to the stored procedure     'SQLJ.DB2_INSTALL_JAR' that can allow 'JAR' files to be     overwritten. Note that this issue only affects Windows     hosts. (#IC84711, CVE-2012-2194)

  - An error exists related to the stored procedures     'GET_WRAP_CFG_C' and 'GET_WRAP_CFG_C2' that can allow     unauthorized access to XML files. (#IC84712,     CVE-2012-2196)

  - An error exists related to the Java stored procedure     infrastructure that can allow stack-based buffer     overflows. (#IC84752, CVE-2012-2197)

According to its version, the installation of IBM DB2 9.8 running on the remote host is prior to Fix Pack 5. It is, therefore, affected by multiple vulnerabilities :

  - An authorized user with 'CONNECT' privileges from     'PUBLIC' can cause a denial of service via unspecified     methods related to DB2's XML feature. (CVE-2012-0712)

  - An unspecified information disclosure vulnerability     exists related to the XML feature that can allow     improper access to arbitrary XML files. (CVE-2012-0713)

  - An error exists related to the Distributed Relational     Database Architecture (DRDA) that can allow denial of     service conditions when processing certain request.
    (CVE-2012-2180)

  - A security bypass vulnerability exists due to the     persistence of privileges when they're removed from     users. An attacker can exploit this to execute non-DDL     statements even if their privileges have been revoked.

  - An unspecified flaw exists that allows an attacker to     cause a denial of service condition when Self Tuning     Memory Manager (STMM) is enabled and DATABASE_MEMORY is     set to AUTOMATIC.

According to its version, the installation of DB2 9.7 running on the remote host is prior to Fix Pack 6. It is, therefore, affected by multiple vulnerabilities :

  - A local user can exploit a vulnerability in the bundled     IBM Tivoli Monitoring Agent (ITMA) to escalate their     privileges. (CVE-2011-4061)

  - An authorized user with 'CONNECT' and 'CREATEIN'     privileges on a database can perform unauthorized     reads on tables. (CVE-2012-0709)

  - An unspecified error in the DB2 Administration Server     (DAS) can allow remote privilege escalation or denial     of service via unspecified vectors. Note that this     issue does not affect Windows hosts. (CVE-2012-0711)

  - An authorized user with 'CONNECT' privileges from     'PUBLIC' can cause a denial of service via unspecified     methods related to DB2's XML feature. (CVE-2012-0712)

  - An unspecified information disclosure error exists     related to the XML feature that can allow improper     access to arbitrary XML files. (CVE-2012-0713)

  - An error exists related to the Distributed Relational     Database Architecture (DRDA) that can allow denial of     service conditions when processing certain request.
    (CVE-2012-2180)

ID	Name	Product	Family	Severity
9196	IBM DB2 9.8 < Fix Pack 5 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
62629	IBM DB2 9.5 < Fix Pack 10 Multiple Vulnerabilities	Nessus	Databases	high
59905	IBM DB2 9.8 < Fix Pack 5 Multiple Vulnerabilities	Nessus	Databases	medium
59904	IBM DB2 9.7 < Fix Pack 6 Multiple Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2012-0713

medium

Tenable Plugins

medium

high

medium

high