IBM DB2 9.5 < 9.5 Fix Pack 7 Multiple Vulnerabilities

Critical Nessus Network Monitor Plugin ID 5750

Synopsis

The remote IBM DB2 database server is affected by multiple vulnerabilities.

Description

Versions of IBM DB2 9.5 earlier than Fix Pack 7 are potentially affected by multiple vulnerabilities :

- A buffer overflow vulnerability exists in the DB2 Administrative Service (DAS). (IC72028)
- It is possible to update statistics for tables without appropriate privileges. (IC71413)
- It is possible for a user to execute a non-DDL statement after role memebership has been revoked from its group. (IC71263)

Solution

Upgrade to IBM DB2 9.5 Fix Pack 7 or higher.

See Also

https://www-304.ibm.com/support/docview.wss?uid=swg21457455

https://www-304.ibm.com/support/docview.wss?uid=swg1IC71413

https://www-304.ibm.com/support/docview.wss?uid=swg1IC71263

https://www-304.ibm.com/support/docview.wss?uid=swg1IC72028

Plugin Details

Severity: Critical

ID: 5750

File Name: 5750.prm

Family: Database

Published: 2011/02/01

Modified: 2016/10/18

Dependencies: 9531

Nessus ID: 51841

Risk Information

Risk Factor: Critical

CVSSv2

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS3#AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 2011/01/31

Vulnerability Publication Date: 2011/01/28

Reference Information

CVE: CVE-2011-0731, CVE-2011-1846, CVE-2011-1847

BID: 46052, 47525