The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors.

According to its version, the installation of IBM DB2 9.1 on the remote host is affected by one or more of the following vulnerabilities : 

  - An unspecified error in 'SQLNLS_UNPADDEDCHARLEN()' may lead to a segmentation fault in DB2 server (LI73364).
  - DB2 does not mark inoperative or drop views and triggers if the definer cannot maintain the objects (IZ22306).
  - Password-related connection string keyword values may appear in trace output (IZ23915).

According to its version, the installation of IBM DB2 9.1 running on the remote host is affected by one or more of the following issues :

  - An unspecified error in 'SQLNLS_UNPADDEDCHARLEN()' may     lead to a segmentation fault in the DB2 server.
    (LI73364)

  - DB2 does not mark inoperative or drop views and triggers     if the definer cannot maintain the objects. (IZ22306)

  - Password-related connection string keyword values may     appear in trace output. (IZ23915)

The installation of IBM DB2 9.5 running on the remote host does not have Fix Pack 2 applied. It is, therefore, affected by the following issues :

  - DB2 does not mark inoperative or drop views and triggers     if the definer cannot maintain the objects (IZ22307).

  - Password-related connection string keyword values may     appear in trace output (IZ28489).

  - There is an unspecified vulnerability in the way CLR     Stored Procedures for Visual Studio from IBM database     add-ins are deployed (JR28431). 

  - There is an unspecified buffer overflow in DAS server     code (IZ22190).

  - INSTALL_JAR can be used to create or overwrite critical     files on a system (IZ22143).

  - On Windows, the db2fmp process is running with OS     privileges (JR30227).

ID	Name	Product	Family	Severity
4721	IBM DB2 9.1 < 9.1 Fix Pack 6 Multiple Vulnerabilities	Nessus Network Monitor	Database	high
34475	IBM DB2 9.1 < Fix Pack 6 Multiple Vulnerabilities	Nessus	Databases	high
34056	IBM DB2 9.5 < Fix Pack 2 Multiple Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2008-4692

critical

Tenable Plugins

high

high

high