IBM DB2 9.7 < 9.7 Fix Pack 3 Multiple Vulnerabilities

critical Nessus Network Monitor Plugin ID 5751

Synopsis

The remote IBM DB2 database server is affected by multiple vulnerabilities.

Description

Versions of IBM DB2 9.7 earlier than Fix Pack 3 are potentially affected by multiple vulnerabilities :

- When privileges on a database object are revoked from PUBLIC, the dependent functions are not marked INVALID. As a result, users with execute privilege on the function are still able to call it successfully. (IC68015)
- If a compound SQL (compiled) statement has been issued by a user that is properly authorized, this is cached in the dynamic SQL cache. Once cached, this same query can be executed by an user if that user has the proper authority. (IC70406)
- Multiple buffer overflow vulnerabilities exist in the DB2 Administrative Server (DAS). (IC70539, IC72029)

Solution

Upgrade to IBM DB2 9.7 Fix Pack 3 or higher.

Plugin Details

Severity: Critical

ID: 5751

Family: Database

Published: 2/1/2011

Updated: 3/6/2019

Nessus ID: 50451

Risk Information

VPR

Risk Factor: Medium

Score: 5.9

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 7.4

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 8.5

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:db2

Patch Publication Date: 9/30/2010

Vulnerability Publication Date: 9/14/2010

Reference Information

CVE: CVE-2010-3474, CVE-2010-3475, CVE-2010-3731, CVE-2011-0731

BID: 43291, 46052, 46077

Detections

Analytics