IBM DB2 and DB2 Connect 9.7 through FP8, 9.8 through FP5, 10.1 through FP2, and 10.5 through FP1 allow remote authenticated users to execute DML statements by leveraging EXPLAIN authority.

According to its version, the installation of IBM DB2 9.7 running on the remote host is prior to Fix Pack 9. It is, therefore, affected by one or more of the following vulnerabilities :

  - The included software, GSKit, contains several errors     related to SSL and TLS that can result in denial of     service, information disclosures, or unauthorized     insertion of an arbitrary root Certification Authority     certificate. (CVE-2012-2190, CVE-2012-2191,     CVE-2012-2203, CVE-2013-0169 / IC90395)

  - A stack-based buffer overflow exists related to     'db2aud' and 'db2flacc' that allows a local attacker     to elevate privileges to that of an instance owner. The     'db2aud' issue does not affect installs on the Windows     operating system. (CVE-2013-3475 / IC92495)

  - An unspecified error exists that allows an attacker to     gain SELECT, INSERT, UPDATE, or DELETE permissions to     database tables. Note that successful exploitation     requires the rights EXPLAIN, SQLADM, or DBADM.
    (CVE-2013-4033 / IC94523)

  - An error exists related to the XSLT parser that allows     a NULL pointer to be dereferenced. (CVE-2013-5466 /     IC97470)

  - An error exists related to queries containing OLAP     specifications that allows remote, authenticated     attackers to close database connections and deactivate     the database. (CVE-2013-6717 / IC95641)

According to its version, the installation of IBM DB2 10.1 on the remote host is affected by the following vulnerabilities :

  - When a multi-node configuration is used, an error exists     in the Fast Communications Manager (FCM) that could     allow denial of service attacks. (CVE-2013-4032 /     IC94434)

  - An unspecified error exists that can allow an attacker     to gain SELECT, INSERT, UPDATE, or DELETE permissions to     database tables. Note that successful exploitation     requires the rights EXPLAIN, SQLADM, or DBADM.
    (CVE-2013-4033 / IC94757)

According to its version, the installation of IBM DB2 10.1 running on the remote host is affected by the following vulnerabilities :

  - A stack-based buffer overflow error exists related to     input validation in the Audit facility and could lead     to privilege escalation and denial of service attacks.
    Note this issue does not affected installs on the     Windows operating system. (CVE-2013-3475 / IC92498)

  - When a multi-node configuration is used, an error exists     in the Fast Communications Manager (FCM) that could     allow denial of service attacks. (CVE-2013-4032 /     IC94434)

  - An unspecified error exists that could allow an attacker     to gain SELECT, INSERT, UPDATE, or DELETE permissions to     database tables. Note that successful exploitation     requires the rights EXPLAIN, SQLADM, or DBADM.
    (CVE-2013-4033 / IC94757)

According to its version, the installation of IBM DB2 10.5 running on the remote host is affected by a security bypass vulnerability. 

An unspecified error exists that can allow an attacker to gain SELECT, INSERT, UPDATE, or DELETE permissions to database tables. 

Note that successful exploitation requires the rights EXPLAIN, SQLADM, or DBADM.

ID	Name	Product	Family	Severity
71519	IBM DB2 9.7 < Fix Pack 9 Multiple Vulnerabilities	Nessus	Databases	critical
70456	IBM DB2 10.1 < Fix Pack 3 Multiple Vulnerabilities (credentialed check)	Nessus	Windows	critical
70455	IBM DB2 10.1 < Fix Pack 3 Multiple Vulnerabilities	Nessus	Databases	high
69800	IBM DB2 10.5 < Fix Pack 1 Security Bypass	Nessus	Databases	medium

Detections

Analytics

CVE-2013-4033

high

Tenable Plugins

critical

critical

high

medium