CVE-2009-4334
Summary
| CVE | CVE-2009-4334 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2009-12-16 18:30:00 UTC |
| Updated | 2026-04-23 00:35:47 UTC |
| Description | The Self Tuning Memory Manager (STMM) component in IBM DB2 9.1 before FP8, 9.5 before FP5, and 9.7 before FP1 uses 0666 permissions for the STMM log file, which allows local users to cause a denial of service or have unspecified other impact by writing to this file. |
Risk And Classification
CVSS v2.0 Breakdown
Access Vector
LocalAccess Complexity
LowAuthentication
NoneConfidentiality
PartialIntegrity
PartialAvailability
PartialAV:L/AC:L/Au:N/C:P/I:P/A:P
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Ibm | Db2 | 9.1 | All | All | All |
| Application | Ibm | Db2 | 9.1 | fp1 | All | All |
| Application | Ibm | Db2 | 9.1 | fp2 | All | All |
| Application | Ibm | Db2 | 9.1 | fp3 | All | All |
| Application | Ibm | Db2 | 9.1 | fp3a | All | All |
| Application | Ibm | Db2 | 9.1 | fp4 | All | All |
| Application | Ibm | Db2 | 9.1 | fp4a | All | All |
| Application | Ibm | Db2 | 9.1 | fp5 | All | All |
| Application | Ibm | Db2 | 9.1 | fp6 | All | All |
| Application | Ibm | Db2 | 9.1 | fp6a | All | All |
| Application | Ibm | Db2 | 9.1 | fp7 | All | All |
| Application | Ibm | Db2 | 9.5 | All | All | All |
| Application | Ibm | Db2 | 9.5 | fp1 | All | All |
| Application | Ibm | Db2 | 9.5 | fp2 | All | All |
| Application | Ibm | Db2 | 9.5 | fp2a | All | All |
| Application | Ibm | Db2 | 9.5 | fp3 | All | All |
| Application | Ibm | Db2 | 9.5 | fp3a | All | All |
| Application | Ibm | Db2 | 9.5 | fp3b | All | All |
| Application | Ibm | Db2 | 9.7 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| IBM IZ50355: STMM LOG FILE PERMISSIONS ARE SET TO 666 AND SHOULD BE 644 | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT | af854a3a-2127-422b-91ae-364da2661108 | ftp.software.ibm.com | |
| IBM notice: The page you requested cannot be displayed | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Vendor Advisory |
| Webmail : Solution de messagerie professionnelle - OVHcloud- OVH | af854a3a-2127-422b-91ae-364da2661108 | www.vupen.com | Vendor Advisory |
| IBM DB2 Multiple Vulnerabilities - Secunia Advisories - Vulnerability Information - Secunia.com | af854a3a-2127-422b-91ae-364da2661108 | secunia.com | Vendor Advisory |
| ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT | af854a3a-2127-422b-91ae-364da2661108 | ftp.software.ibm.com | |
| IBM DB2 prior to 9.5 Fix Pack 5 Multiple Unspecified Security Vulnerabilities | af854a3a-2127-422b-91ae-364da2661108 | www.securityfocus.com | |
| IBM Fix List for DB2 Version 9.5 for Linux, UNIX and Windows - United States | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | Patch |
| ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v97/APARLIST.TXT | af854a3a-2127-422b-91ae-364da2661108 | ftp.software.ibm.com | |
| IBM notice: The page you requested cannot be displayed | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| IBM IC64019: STMM LOG FILE PERMISSIONS ARE SET TO 666 AND SHOULD BE 644 | af854a3a-2127-422b-91ae-364da2661108 | www-01.ibm.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.