The Common Code Infrastructure component in IBM DB2 8 before FP17, 9.1 before FP7, and 9.5 before FP4, when LDAP security (aka IBMLDAPauthserver) and anonymous bind are enabled, allows remote attackers to bypass password authentication and establish a database connection via unspecified vectors.

According to its version, the installation of IBM DB2 9.1 on the remote host is affected by one or more of the following vulnerabilities : 

  - MODIFIED SQL DATA table function is not dropped when definer loses required privileges to maintain the objects. (IZ46773/IZ46774)
  - A user without sufficient privileges could insert, update, or delete rows in a table. (IZ50078/IZ50079)
  - A user can perform 'SET SESSION AUTHORIZATION' without 'SETSESSIONUSER' privilege. (IZ55883)

The IBM DB2 database server running on the remote host is prior to 9.5 Fix Pack 4. It is, therefore, affected by  multiple issues :

  - It may be possible to connect to DB2 servers without     valid passwords, provided LDAP-based authentication     is used and the remote LDAP server is configured to     allow anonymous binds. (JR32268)

  - It may be possible to trigger a denial of service     condition by sending malicious 'connect' data stream.
    (IZ37697)

  - By connecting to a DB2 server using a third-party DRDA     client that uses IPV6 address format of the correlation     token, it may be possible to crash the remote DB2     server. (IZ38874)

  - MODIFIED SQL DATA table function is not dropped even if     the maintainer does not have privileges to maintain the     objects. (IZ46774)

  - The 'DASAUTO' command can be run by a non-privileged     user. (IZ40352)

  - It may be possible for an unauthorized user to insert,     update, or delete rows in a table. (IZ50079)

According to its version, the IBM DB2 server running on the remote host is prior to 9.1 Fix Pack 7. It is, therefore, affected by multiple vulnerabilities :

  - In certain situations an INNER JOIN predicate is applied     before the OUTER JOIN predicate, which could result in     disclosure of sensitive information. (JR31886)

  - It may be possible to connect to DB2 servers without     valid passwords, provided LDAP-based authentication     is used, and the remote LDAP server is configured to     allow anonymous binds. (JR32272)

  - By connecting to a DB2 server using a third-party DRDA     client that uses IPV6 address format of the correlation     token, it may be possible to crash the remote DB2     server. (IZ36683)

According to its version, the installation of IBM DB2 9.1 / 9.5 on the remote host is affected by one or more of the following vulnerabilities : 

  - A denial-of-service issue when the application processes crafted IPv6 addresses in the correlation token. (IZ38874)
  - A security-bypass issue exists in the application when LDAP-based authentication is used. (LI73778)

ID	Name	Product	Family	Severity
5190	IBM DB2 9.1 < 9.1 Fix Pack 8 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
39007	IBM DB2 < 9.5 Fix Pack 4 Multiple Vulnerabilities	Nessus	Databases	medium
36216	IBM DB2 9.1 < Fix Pack 7 Multiple Vulnerabilities	Nessus	Databases	medium
5043	IBM DB2 9.1 < 9.1 Fix Pack 7 / 9.5 < 9.5 Fix Pack 4 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium

Detections

Analytics

CVE-2009-1905

critical

Tenable Plugins

medium

medium

medium

medium