Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.

According to its version, the installation of IBM DB2 running on the remote host is version 9.8 prior or equal to Fix Pack 5. It is, therefore, affected by one or more of the following vulnerabilities :

  - An unspecified error exists in the GSKit component when     initiating SSL/TLS connections due to improper handling     of malformed X.509 certificate chains. A remote attacker     can exploit this to cause a denial of service.
    (CVE-2013-6747)

  - Untrusted search path vulnerabilities exist in     unspecified setuid and setgid programs that allow a     local attacker to gain root privileges by using a     trojan horse library. (CVE-2014-0907)

  - An unspecified error exists in the reverse proxy GSKit     component that allows a remote attacker to exhaust CPU     resources by using crafted SSL messages, resulting in a     denial of service. (CVE-2014-0963)

  - An unspecified error exists during the handling of     SELECT statements with XML/XSLT functions that allows a     remote attacker to gain access to arbitrary files.
    (CVE-2014-8910)

  - A flaw exists in the LUW component when handling SQL     statements with unspecified Scaler functions. A remote,     authenticated attacker can exploit this to cause a     denial of service. (CVE-2015-0157)

  - An unspecified flaw in the General Parallel File System     (GPFS) allows a local attacker to gain root privileges.
    CVE-2015-0197)

  - A flaw exists in the General Parallel File System     (GPFS), related to certain cipherList configurations,     that allows a remote attacker, using specially crafted     data, to bypass authentication and execute arbitrary     programs with root privileges. (CVE-2015-0198)

  - A denial of service vulnerability exists in the General     Parallel File System (GPFS) that allows a local attacker     to corrupt the kernel memory by sending crafted ioctl     character device calls to the mmfslinux kernel module.
    (CVE-2015-0199)

  - An information disclosure vulnerability exists in the     automated maintenance feature. An attacker with elevated     privileges, by manipulating a stored procedure, can     exploit this issue to disclose arbitrary files owned by     the DB2 fenced ID on UNIX/Linux or the administrator on     Windows. (CVE-2015-1883)

  - A flaw exists in the Data Movement feature when handling     specially crafted queries. An authenticated, remote     attacker can exploit this to delete database rows from a     table without having the appropriate privileges.
    (CVE-2015-1922)

  - A flaw exists when handling SQL statements having     unspecified LUW Scaler functions. An authenticated,     remote attacker can exploit this to run arbitrary code,     under the privileges of the DB2 instance owner, or to     cause a denial of service. (CVE-2015-1935)

According to its version, the installation of DB2 9.7 running on the remote host is prior to Fix Pack 9a. It is, therefore, affected by one or more of the following vulnerabilities :

  - An unspecified error exists related to handling     malformed certificate chains that allows denial     of service attacks. (CVE-2013-6747)

  - A build error exists related to libraries in insecure     locations that allows a local user to carry out     privilege escalation attacks. Note that this issue does     not affect the application when running on Microsoft     Windows operating systems. (CVE-2014-0907)

  - An unspecified error exists related to the TLS     implementation that allows certain error cases to cause     100% CPU utilization. (CVE-2014-0963)

According to its version, the installation of IBM DB2 9.5 running on the remote host is prior or equal to Fix Pack 9 or 10. It is, therefore, reportedly affected by one or more of the following vulnerabilities :

  - An unspecified error exists related to handling     malformed certificate chains that could allow denial     of service attacks. (CVE-2013-6747)

  - A build error exists related to libraries in insecure     locations that could allow a local user to carry out     privilege escalation attacks. Note this issue does not     affect the application when running on Microsoft     Windows operating systems. (CVE-2014-0907)

  - An unspecified error exists related to the TLS     implementation that could allow certain error cases to     cause 100% CPU utilization. (CVE-2014-0963)

According to its version, the installation of IBM DB2 10.5 running on the remote host is prior to Fix Pack 3a. It is, therefore, affected by one or more of the following vulnerabilities :

  - An unspecified error exists related to handling     malformed certificate chains that could allow denial     of service attacks. (CVE-2013-6747)

  - A build error exists related to libraries in insecure     locations that could allow a local user to carry out     privilege escalation attacks. Note this issue does not     affect the application when running on Microsoft     Windows operating systems. (CVE-2014-0907)

  - An unspecified error exists related to the TLS     implementation that could allow certain error cases to     cause 100% CPU utilization. (CVE-2014-0963)

According to its version, the installation of IBM DB2 10.1 running on the remote host is prior to Fix Pack 3a. It is, therefore, affected by one or more of the following vulnerabilities :

  - The included version of GSKit contains an error     related to CBC-mode and timing that could allow an     attacker to recover plaintext from encrypted     communications. (CVE-2013-0169)

  - An unspecified error exists related to handling     malformed certificate chains that could allow denial     of service attacks. (CVE-2013-6747)

  - A build error exists related to libraries in insecure     locations that could allow a local user to carry out     privilege escalation attacks. Note this issue does not     affect the application when running on Microsoft     Windows operating systems. (CVE-2014-0907)

  - An unspecified error exists related to the TLS     implementation that could allow certain error cases to     cause 100% CPU utilization. (CVE-2014-0963)

ID	Name	Product	Family	Severity
76115	IBM DB2 9.8 <= Fix Pack 5 Multiple Vulnerabilities	Nessus	Databases	critical
76114	IBM DB2 9.7 < Fix Pack 9a Multiple Vulnerabilities	Nessus	Databases	high
76113	IBM DB2 9.5 <= Fix Pack 9 or 10 Multiple Vulnerabilities	Nessus	Databases	high
76111	IBM DB2 10.5 < Fix Pack 3a Multiple Vulnerabilities	Nessus	Databases	high
76110	IBM DB2 10.1 < Fix Pack 3a Multiple Vulnerabilities	Nessus	Databases	high

Detections

Analytics

CVE-2014-0907

high

Tenable Plugins

critical

high

high

high

high