IBM DB2 9.7 < 9.7 Fix Pack 4 Multiple Vulnerabilities

Medium Nessus Network Monitor Plugin ID 5896

Synopsis

The remote IBM DB2 database server is affected by multiple vulnerabilities.

Description

Versions of IBM DB2 9.7 earlier than Fix Pack 4 are potentially affected by multiple vulnerabilities :

- It may be possible for users to updates statistics for tables without appropriate privileges. (IC72119)
- Users continue to have privilege to execute a non-DDL statement after role membership has been revoked from its group. (IC71375)

Solution

Upgrade to IBM DB2 9.7 Fix Pack 4 or higher.

See Also

https://www-304.ibm.com/support/docview.wss?uid=swg21450666

http://www.ibm.com/support/docview.wss?uid=swg1IC72119

http://www.ibm.com/support/docview.wss?uid=swg1IC71375

Plugin Details

Severity: Medium

ID: 5896

File Name: 5896.prm

Family: Database

Published: 2011/04/22

Modified: 2016/10/18

Dependencies: 9531

Nessus ID: 53547

Risk Information

Risk Factor: Medium

CVSSv2

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

Temporal Vector: CVSS2#E:U/RL:OF/RC:C

CVSSv3

Base Score: 5.3

Temporal Score: 4.6

Vector: CVSS3#AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS3#E:U/RL:O/RC:C

Vulnerability Information

Patch Publication Date: 2011/04/20

Vulnerability Publication Date: 2011/04/20

Reference Information

CVE: CVE-2011-1846, CVE-2011-1847

BID: 47525