Detections
Analytics
IBM DB2 9.1 < 9.1 Fix Pack 10 Multiple Vulnerabilities
critical Nessus Network Monitor Plugin ID 5749
Synopsis
The remote IBM DB2 database server is affected by multiple vulnerabilities.Description
Versions of IBM DB2 9.1 earlier than Fix Pack 10 are potentially affected by multiple vulnerabilities :- Multiple buffer overflow vulnerabilities exist in the DB2 Administrative Service (DAS) which could lead to a denial-of-service, or the execution of arbitrary code. (IC69986, IC71203)
- Users continue to have privilege to execute a non-DDL statement after their DBADM authority has been revoked. (IC66811)
Solution
Upgrade to IBM DB2 9.1 Fix Pack 10 or higher.See Also
http://www.zerodayinitiative.com/advisories/ZDI-11-035
http://www.zerodayinitiative.com/advisories/ZDI-11-036
https://www-304.ibm.com/support/docview.wss?uid=swg1IC66811
https://www-304.ibm.com/support/docview.wss?uid=swg1IC69986
Plugin Details
Severity: Critical
ID: 5749
Family: Database
Published: 6/1/2010
Updated: 3/6/2019
Nessus ID: 51840
Risk Information
VPR
Risk Factor: Medium
Score: 5.9
CVSS v2
Risk Factor: Critical
Base Score: 10
Temporal Score: 7.4
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Temporal Score: 8.5
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
CPE: cpe:/a:ibm:db2
Patch Publication Date: 5/28/2010
Vulnerability Publication Date: 5/28/2010