IBM DB2 8 before FP18, 9.1 before FP8, and 9.5 before FP4 allows remote authenticated users to bypass intended access restrictions, and update, insert, or delete table rows, via unspecified vectors.

According to its version, the IBM DB2 server running on the remote host is prior to 9.1 Fix Pack 8. It is, therefore, affected by multiple vulnerabilities :

  - MODIFIED SQL DATA table function is not dropped even if     the maintainer does not have privileges to maintain the     objects. (IZ46773)

  - It may be possible for an unauthorized user to insert,     update, or delete rows in a table. (IZ50078)  
  - An user without 'SETSESSIONUSER' privilege can perform     'SET SESSION AUTHORIZATION'. (IZ55883)

  - The 'DASAUTO' command can be run by a non-privileged     user. (IZ40340)

According to its version, the installation of IBM DB2 9.1 on the remote host is affected by one or more of the following vulnerabilities : 

  - MODIFIED SQL DATA table function is not dropped when definer loses required privileges to maintain the objects. (IZ46773/IZ46774)
  - A user without sufficient privileges could insert, update, or delete rows in a table. (IZ50078/IZ50079)
  - A user can perform 'SET SESSION AUTHORIZATION' without 'SETSESSIONUSER' privilege. (IZ55883)

The IBM DB2 database server running on the remote host is prior to 9.5 Fix Pack 4. It is, therefore, affected by  multiple issues :

  - It may be possible to connect to DB2 servers without     valid passwords, provided LDAP-based authentication     is used and the remote LDAP server is configured to     allow anonymous binds. (JR32268)

  - It may be possible to trigger a denial of service     condition by sending malicious 'connect' data stream.
    (IZ37697)

  - By connecting to a DB2 server using a third-party DRDA     client that uses IPV6 address format of the correlation     token, it may be possible to crash the remote DB2     server. (IZ38874)

  - MODIFIED SQL DATA table function is not dropped even if     the maintainer does not have privileges to maintain the     objects. (IZ46774)

  - The 'DASAUTO' command can be run by a non-privileged     user. (IZ40352)

  - It may be possible for an unauthorized user to insert,     update, or delete rows in a table. (IZ50079)

ID	Name	Product	Family	Severity
42044	IBM DB2 9.1 < Fix Pack 8 Multiple Vulnerabilities	Nessus	Databases	medium
5190	IBM DB2 9.1 < 9.1 Fix Pack 8 Multiple Vulnerabilities	Nessus Network Monitor	Database	medium
39007	IBM DB2 < 9.5 Fix Pack 4 Multiple Vulnerabilities	Nessus	Databases	medium

Detections

Analytics

CVE-2009-3472

medium

Tenable Plugins

medium

medium

medium