This script is Copyright (C) 2009-2016 Tenable Network Security, Inc.
The remote database server is affected by multiple issues.
According to its version, the IBM DB2 server running on the remote
host is prior to 9.1 Fix Pack 7. It is, therefore, affected by
multiple vulnerabilities :
- In certain situations an INNER JOIN predicate is applied
before the OUTER JOIN predicate, which could result in
disclosure of sensitive information. (JR31886)
- It may be possible to connect to DB2 servers without
valid passwords, provided LDAP-based authentication
is used, and the remote LDAP server is configured to
allow anonymous binds. (JR32272)
- By connecting to a DB2 server using a third-party DRDA
client that uses IPV6 address format of the correlation
token, it may be possible to crash the remote DB2
See also :
Apply IBM DB2 Version 9.1 Fix Pack 7 or later.
Risk factor :
Medium / CVSS Base Score : 5.0
CVSS Temporal Score : 4.1
Public Exploit Available : true