IBM DB2 JOIN Predicate Application Order Information Disclosure Vulnerability

Bugtraq ID:	34650
Class:	Design Error
CVE:	CVE-2009-1239
Remote:	Yes
Local:	No
Published:	Apr 02 2009 12:00AM
Updated:	Apr 02 2009 12:00AM
Credit:	The vendor.
Vulnerable:	IBM DB2 Universal Database 9.1 Fix Pack 6a IBM DB2 Universal Database 9.1 Fix Pack 6 IBM DB2 Universal Database 9.1 Fix Pack 4a IBM DB2 Universal Database 9.1 IBM DB2 Universal Database 8.2 FixPak 8 IBM DB2 Universal Database 8.2 IBM DB2 Universal Database 8.1 FixPak 15 IBM DB2 Universal Database 8.1 IBM DB2 Universal Database 8.0.0 FixPak 16 IBM DB2 Universal Database 8.0
Not Vulnerable:	IBM DB2 Universal Database 9.1 Fix Pack 7

IBM DB2 JOIN Predicate Application Order Information Disclosure Vulnerability

IBM DB2 is prone to an information-disclosure vulnerability due to an error in handling SQL JOIN predicates.

Exploiting this issue may allow an attacker to access sensitive information that may aid in further attacks.

Versions prior to DB2 Fixpack 7 are vulnerable.

IBM DB2 JOIN Predicate Application Order Information Disclosure Vulnerability

An attacker can use readily available tools to exploit this issue.

IBM DB2 JOIN Predicate Application Order Information Disclosure Vulnerability

Solution:
The vendor has released updates. Please contact the vendor for details.

IBM DB2 JOIN Predicate Application Order Information Disclosure Vulnerability

References:

• HIPER APARs fixed in DB2 for Linux, UNIX, and Windows Version 9.1 Fix Pack 7 (IBM)
  
• IBM DB2 Homepage (IBM)
  
• JR31886: A QUERY MAY RETURN INCORRECT RESULTS WHEN ITS OUTER JOIN OPERATOR IS EX (IBM)