IBM DB2 Multiple Security Vulnerabilities

Bugtraq ID:	53873
Class:	Unknown
CVE:	CVE-2012-2180 CVE-2012-0713
Remote:	Yes
Local:	Yes
Published:	Jun 05 2012 12:00AM
Updated:	Oct 09 2018 04:00PM
Credit:	The vendor and anonymous person via iDefense Vulnerability Contributor Program.
Vulnerable:	IBM DB2® Workgroup Server Edition 9.5 IBM DB2® Express Edition 9.5 IBM DB2® Enterprise Server Edition 9.5 IBM DB2® Connect�?� Unlimited Edition for System z® 9.5 IBM DB2® Connect�?� Unlimited Edition for System i® 9.5 IBM DB2® Connect�?� Enterprise Edition 9.5 IBM DB2® Connect�?� Application Server Edition 9.5 IBM DB2® Advanced Enterprise Server Edition 9.5 IBM DB2 Express Edition 9.7 IBM DB2 Connect Unlimited Edition for System z 9.7 IBM DB2 Connect Unlimited Edition for System i 9.7 IBM DB2 Connect Enterprise Edition 9.7 IBM DB2 Connect Application Server Edition 9.7 IBM DB2 Workgroup Server Edition 9.7 IBM DB2 pureScale�?� Feature for Enterprise Server Edition 9.8 IBM DB2 Express Edition 9.7 IBM DB2 Enterprise Server Edition 9.7 IBM DB2 Advanced Enterprise Server Edition 9.7 IBM DB2 9.8 IBM DB2 9.7 IBM DB2 9.5
Not Vulnerable:	IBM DB2 9.7 Fix Pack 6 0 IBM DB2 9.8 Fix Pack 5 IBM DB2 9.5 Fix Pack 10

IBM DB2 Multiple Security Vulnerabilities

IBM DB2 is prone to multiple security vulnerabilities including:

1. A privilege escalation vulnerability.
2. Multiple denial-of-service vulnerabilities.
3. A security bypass vulnerability.
4. An information-disclosure vulnerability.

An attacker can exploit these vulnerabilities to disclose sensitive information, gain elevated privileges, bypass security restrictions, or deny service to legitimate users. Other attacks are also possible.

IBM DB2 Multiple Security Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

IBM DB2 Multiple Security Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

IBM DB2 Multiple Security Vulnerabilities

References:

• IBM DB2 Homepage (IBM)
  
• IC79274: SECURITY: DB2 ESCALATION OF PRIVILEGE VULNERABILITY (IBM)
  
• IC80729: SECURITY: REMOTE ESCALATION OF PRIVILEGE VULNERABILITY IN DAS. (IBM)
  
• IC81380: SECURITY: DENIAL OF SERVICE SECURITY VULNERABILITY IN DB2'S XML FEATURE (IBM)
  
• IC81462: SECURITY: UNAUTHORIZED ACCESS TO XML FILES IN DB2'S XML FEATURE (IBM)
  
• IC81462: SECURITY: UNAUTHORIZED ACCESS TO XML FILES IN DB2'S XML FEATURE (IBM)
  
• IC81461: SECURITY: UNAUTHORIZED ACCESS TO XML FILES IN DB2'S XML FEATURE (CVE-2 (IBM)
  
• DB2 Version 9.8 Fix Pack 5 for AIX and Linux (IBM)
  
• IC81836: SECURITY: UNAUTHORIZED ACCESS TO TABLES (IBM)
  
• IC81837: SECURITY: DENIAL OF SERVICE SECURITY VULNERABILITY IN DB2'S XML FEATURE (IBM)
  
• IC81839: SECURITY: UNAUTHORIZED ACCESS TO XML FILES IN DB2'S XML FEATURE (CVE-20 (IBM)
  
• Security Bulletin: DB2 Denial of Service Vulnerability in DRDA (CVE-2012-2180) (IBM)
  
• Security Vulnerabilities and HIPER APARs fixed in DB2 for Linux, UNIX, and Windo (IBM)
  
• Security Vulnerabilities, HIPER and Special Attention APARs fixed in DB2 Version (IBM)
  
• Unauthorized File Access Security Vulnerability in DB2 XML Feature (CVE-2012-071 (IBM)