Detections
Analytics

IBM DB2 9.7 < 9.7 Fix Pack 4 Multiple Vulnerabilities

medium Nessus Network Monitor Plugin ID 5896

Synopsis

The remote IBM DB2 database server is affected by multiple vulnerabilities.

Description

Versions of IBM DB2 9.7 earlier than Fix Pack 4 are potentially affected by multiple vulnerabilities :

 - It may be possible for users to updates statistics for tables without appropriate privileges. (IC72119)
 - Users continue to have privilege to execute a non-DDL statement after role membership has been revoked from its group. (IC71375)

Solution

Upgrade to IBM DB2 9.7 Fix Pack 4 or higher.

See Also

https://www-304.ibm.com/support/docview.wss?uid=swg21450666

http://www.ibm.com/support/docview.wss?uid=swg1IC72119

http://www.ibm.com/support/docview.wss?uid=swg1IC71375

Plugin Details

Severity: Medium

ID: 5896

Family: Database

Published: 4/22/2011

Updated: 3/6/2019

Nessus ID: 53547

Risk Information

VPR

Risk Factor: Medium

Score: 5.8

CVSS v2

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.1

Vector: CVSS2#AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS v3

Risk Factor: Medium

Base Score: 5.4

Temporal Score: 4.7

Vector: CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

CPE: cpe:/a:ibm:db2

Patch Publication Date: 4/20/2011

Vulnerability Publication Date: 4/20/2011

Reference Information

CVE: CVE-2011-1846, CVE-2011-1847

BID: 47525