According to its version, the installation of IBM DB2 10.5 running on the remote host is prior to Fix Pack 8. It is, therefore, affected by the following vulnerabilities :

  - A local privilege escalation vulnerability exists due to     insecurely loading binaries planted in a location that a     SETGID or SETUID binary would execute. A local attacker     can exploit this, via a malicious binary, to gain root     privileges. (CVE-2016-5995)

  - A denial of service vulnerability exists in the     SQLNP_SCOPE_TRIAL() function due to improper handling of     SQL statements. An authenticated, remote attacker can     exploit this to crash the database.

  - A denial of service vulnerability exists in the Query     Compiler QGM due to improper handling of specific     queries. An authenticated, remote attacker can exploit     this, via a specially crafted query, to crash the     database.

Versions of IBM DB2 10.1 earlier than Fix Pack 5 are potentially affected by multiple vulnerabilities :

 - An unspecified flaw exists in the monitoring or audit facility due to passwords being stored when handling specially crafted commands.  A remote, authenticated attacker can exploit this to access sensitive information. (CVE-2014-0919)
 - A stack-based buffer overflow condition exists due to improper validation of user-supplied input when handling crafted 'ALTER MODULE' statements.  A remote, authenticated attacker can exploit this to cause a denial of service or execute arbitrary code. (CVE-2014-3094)
 - A flaw exists when handling a crafted 'UNION' clause in a subquery of a 'SELECT' statement.  A remote, authenticated attacker can exploit this to cause a denial of service. (CVE-2014-3095)
 - A denial of service vulnerability exists when immediate 'AUTO_REVAL' is enabled.  A remote, authenticated attacker can exploit this, via a crafted 'ALTER TABLE' statement, to crash the server. (CVE-2014-6159)
 - A denial of service vulnerability exists when handling an identity column within a crafted 'ALTER TABLE' statement.  A remote, authenticated attacker can exploit this vulnerability to crash the server. (CVE-2014-6209)
 - A denial of service vulnerability exists when handling multiple 'ALTER TABLE' statements specifying the same column.  A remote, authenticated attacker can exploit this vulnerability to crash the server. (CVE-2014-6210)
 - A flaw exists that is triggered when handling specially crafted XML queries.  A remote, authenticated attacker can exploit this to cause a consumption of resources, resulting in a denial of service. (CVE-2014-8901)
 - A flaw exists in the IBM Global Security Kit (GSKit) when handling RSA temporary keys in a non-export RSA key exchange ciphersuite.  A man-in-the-middle attacker can exploit this to downgrade the session security to use weaker EXPORT_RSA ciphers, thus allowing the attacker to more easily monitor or tamper with the encrypted stream. (CVE-2015-0138)
 - An unspecified flaw in the General Parallel File System (GPFS) allows a local attacker to gain root privileges. (CVE-2015-0197)
 - A flaw exists in the General Parallel File System (GPFS), related to certain cipherList configurations, that allows a remote attacker, using specially crafted data, to bypass authentication and execute arbitrary programs with root privileges. (CVE-2015-0198)
 - A denial of service vulnerability exists in the General Parallel File System (GPFS) that allows a local attacker to corrupt kernel memory by sending crafted ioctl character device calls to the mmfslinux kernel module. (CVE-2015-0199)
 - A security feature bypass vulnerability exists, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase.  A man-in-the-middle attacker can exploit this, via a brute-force attack using LSB values, to decrypt the traffic. (CVE-2015-2808)
 - An information disclosure vulnerability exists due to improper block cipher padding by TLSv1 when using Cipher Block Chaining (CBC) mode.  A remote attacker, via an 'Oracle Padding' side channel attack, can exploit this vulnerability to gain access to sensitive information.  Note that this is a variation of the 'POODLE' attack.
 - A double-free flaw exists in the CLI application.  The issue is triggered as user-supplied input is not properly validated when handling client disconnects.  This may allow a remote attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code.
 - A flaw exists that is triggered when handling 'SUM' or 'GROUP' BY queries with a 'SUBSELECT' that contains unnest.  This may allow an attacker to cause the database to crash.
 - An unspecified flaw exists in the 'sqldRemoveCachedTableEntry()' function that may allow an authenticated attacker to cause a DB2 instance to crash.
 - A flaw exists that is triggered as user-supplied input is not properly validated when handling Partial Aggregation operators (PED, PEA).  This may allow an authenticated attacker to corrupt memory and cause a denial of service.
 - A flaw exists that is due to the program setting insecure 666 permissions for log files.  This may allow a local attacker to manipulate logs.
 - A flaw exists in the 'sqlex_find_group()' function in the handling of group names.  This issue is triggered when returning a cumulative group name length greater than 64k for a user id.  This may allow an authenticated attacker to crash the server.
 - A flaw exists in the 'sqlsBinSortPopulateRecPointers()' function.  The issue is triggered as user-supplied input is not properly validated when performing resettable sorts.  This may allow an authenticated attacker to corrupt memory and cause a denial of service.
 - A flaw exists that is triggered when handling generated tables with 'INSERT INTO' statements.  This may allow an authenticated attacker to cause DB2 to crash.
 - A flaw exists that is triggered when invoking runstats against a user temporary table while the index clause explicitly specifies index names while omitting the index scheme name.  This may allow an authenticated attacker to cause a crash.
 - A flaw exists in the DRDA communication protocol that is triggered during the handling of messages.  This may allow an authenticated remote attacker to trigger a large memory overwrite.
 - A flaw exists that is due to the program insecurely loading binaries planted in a location that a SETGID or SETUID binary would execute. This may allow a local attacker to gain elevated, root privileges.

Versions of IBM DB2 9.7 prior to Fix Pack 11 are potentially affected by multiple vulnerabilities :

 - A flaw exists in the query compiler QGM that is triggered when handling duplicate reloc entry queries. This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'SQLEX_FIND_GROUP()' function that is triggered during the handling of group name results. This may allow an authenticated attacker to crash the database.
 - A flaw exists in the Query Compiler QGM that is triggered during the handling of 'DBCLOB' column types. This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'SQLRA_GET_SECT_INFO_BY_CURSOR_NAME()' function in 'Relational Data Services' that is triggered during the handling of stored procedures. This may allow an authenticated attacker to crash the database.
 - A flaw exists that is due to the program insecurely loading binaries planted in a location that a SETGID or SETUID binary would execute. This may allow a local attacker to gain elevated, root privileges.

Versions of IBM DB2 10.5 prior to Fix Pack 8 and 11.x prior to 11.1 are potentially affected by multiple vulnerabilities :

 - An unspecified flaw exists that may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists that may allow a local attacker to gain access to arbitrary memory locations. No further details have been provided by the vendor.
 - An unspecified flaw exists that is triggered when dereferencing user pointers. This may allow a local attacker to crash the file system.
 - A flaw exists in the 'DTDScanner::scanChildren()' function in 'validators/DTD/DTDScanner.cpp' that is triggered when handling user requests. With a specially crafted request, a context-dependent attacker can cause the application linked against the library to exhaust resources causing it to stop responding or crash.
 - A flaw exists that is triggered when a local attacker sets environment variables that are processed by setuid programs. This may allow the attacker to execute commands with root privileges.
 - A flaw exists that is triggered when a local attacker supplies command line parameters to setuid programs. This may allow the attacker to execute commands with root privileges.
 - An overflow condition exists that is triggered as certain input is not properly validated. This may allow an authenticated remote attacker to cause a buffer overflow, potentially allowing them to bypass security restrictions and disclose sensitive information.
 - A flaw exists that is due to the program insecurely loading binaries planted in a location that a SETGID or SETUID binary would execute. This may allow a local attacker to gain elevated, root privileges.
 - A flaw exists in the 'SQLNP_SCOPE_TRIAL()' function that is triggered during the handling of SQL statements. This may allow an authenticated attacker to crash the database.
 - Multiple flaws exist in the Query Compiler QGM that is triggered when handling specific queries. With a specially crafted query, an authenticated attacker can cause the database to crash.

ID	Name	Product	Family	Published	Updated	Severity
94898	IBM DB2 10.5 < Fix Pack 8 Multiple Vulnerabilities	Nessus	Databases	11/15/2016	7/26/2022	high
9197	IBM DB2 10.1 < Fix Pack 5 Multiple Vulnerabilities (Bar Mitzvah)	Nessus Network Monitor	Database	4/15/2016	3/6/2019	critical
9589	IBM DB2 9.7 < Fix Pack 11 Multiple Vulnerabilities	Nessus Network Monitor	Database	9/30/2016	3/6/2019	medium
9590	IBM DB2 10.5 < Fix Pack 8 / 11.x < 11.1 Multiple Vulnerabilities	Nessus Network Monitor	Database	9/30/2016	3/6/2019	critical

Detections

Analytics

Plugins Search

high

critical

medium

critical