IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow, which could allow an authenticated local attacker to execute arbitrary code on the system as root. IBM X-Force ID: 155892.

IBM Spectrum Protect, formerly known as Tivoli Storage Manager, installed on the remote host is version 7.1.x < 7.1.9.300 or 8.1.x < 8.1.8. It is, therefore, affected by multiple IBM Db2 remote code execution and privilege escalation vulnerabilities. These vulnerabilities could allow an attacker to gain system-level access to the affected host.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

According to its version, the installation of IBM DB2 running on the remote host is either 9.7 prior to Fix Pack 11 Special Build 38744, 10.1 prior to Fix Pack 6 Special Build 38745, 10.5 prior to Fix Pack 10 Special Build 38746, or 11.1 prior to 11.1.4 Fix Pack 4a Special Build 38747. It is, therefore, affected by a local privilege escalation vulnerability due to multiple buffer overflow vulnerabilities in DB2.

According to its version, the installation of IBM DB2 running on the remote host is either 9.7 prior to Fix Pack 11 Special Build 38744, 10.1 prior to Fix Pack 6 Special Build 38745, 10.5 prior to Fix Pack 10 Special Build 38746, or 11.1 prior to Mod 4 Fix Pack 5. It is, therefore, affected by a local privilege escalation vulnerability due to multiple buffer overflow vulnerabilities in DB2.

ID	Name	Product	Family	Severity
126987	IBM Spectrum Protect 7.1.x < 7.1.9.300 / 8.1.x < 8.1.8 Multiple Vulnerabilities	Nessus	General	high
126636	IBM DB2 9.7 < FP11 Special Build 38744 / 10.1 < FP6 Special Build 38745 / 10.5 < FP10 Special Build 38746 / 11.1.4 < FP4a Special Build 38747 Buffer Overflow Vulnerability (Windows)	Nessus	Windows	high
126635	IBM DB2 9.7 < FP11 Special Build 38744 / 10.1 < FP6 Special Build 38745 / 10.5 < FP10 Special Build 38746 / 11.1 < M4FP5 Buffer Overflow Vulnerability (UNIX)	Nessus	Databases	high

Detections

Analytics

CVE-2019-4014

high

Tenable Plugins

high

high

high