IBM DB2 10.5 < Fix Pack 7 Multiple Vulnerabilities

high Nessus Network Monitor Plugin ID 9200

Synopsis

The remote IBM DB2 database server is vulnerable to multiple attack vectors.

Description

Versions of IBM DB2 10.5 earlier than Fix Pack 7 are potentially affected by multiple vulnerabilities :

- A flaw exists that is due to the program setting insecure permissions for the Self Tuning Memory Manager (STMM) log file. This may allow a local attacker to read or write to log files.
- A flaw exists related to the improper building of binaries. This may allow a local attacker plant a malicious library in a specific location to gain elevated privileges.
- A flaw exists in multiple methods that is triggered during the handling of queries. This may allow an authenticated attacker to crash the database.

Solution

Upgrade to IBM DB2 10.5 Fix Pack 7 or higher.

Plugin Details

Severity: High

ID: 9200

Family: Database

Published: 4/15/2016

Updated: 3/6/2019

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: High

Base Score: 7.2

Temporal Score: 6.3

Vector: CVSS2#AV:L/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: High

Base Score: 8.4

Temporal Score: 8

Vector: CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:X/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:infosphere_biginsights

Patch Publication Date: 12/30/2015

Vulnerability Publication Date: 12/30/2015

Reference Information

CVE: CVE-2015-1947

Detections

Analytics