IBM DB2 and DB2 Connect Audit Facility Local Privilege Escalation Vulnerability
BID:60255
Info
IBM DB2 and DB2 Connect Audit Facility Local Privilege Escalation Vulnerability
| Bugtraq ID: | 60255 |
| Class: | Design Error |
| CVE: |
CVE-2013-3475 |
| Remote: | No |
| Local: | Yes |
| Published: | May 31 2013 12:00AM |
| Updated: | Sep 24 2018 11:00AM |
| Credit: | Bartlomiej Balcerek via Secunia SVCRP. |
| Vulnerable: |
IBM Smart Analytics System 7710 0 IBM Smart Analytics System 7700 0 IBM Smart Analytics System 7600 0 IBM PureData System for Operational Analytics A1791 0 IBM DB2 Workgroup Server Edition 9.7 IBM DB2 Workgroup Server Edition 9.5 IBM DB2 Workgroup Server Edition 9.1 IBM DB2 Workgroup Server Edition 10.1 IBM DB2 pureScale Feature for Enterprise Server Edition 9.8 IBM DB2 Express Edition 9.7 IBM DB2 Express Edition 9.5 IBM DB2 Express Edition 9.1 IBM DB2 Express Edition 10.1 IBM DB2 Enterprise Server Edition 9.7 IBM DB2 Enterprise Server Edition 9.5 IBM DB2 Enterprise Server Edition 9.1 IBM DB2 Enterprise Server Edition 10.1 IBM DB2 Connect Unlimited Edition for System z 9.7 IBM DB2 Connect Unlimited Edition for System z 9.5 IBM DB2 Connect Unlimited Edition for System z 9.1 IBM DB2 Connect Unlimited Edition for System z 10.1 IBM DB2 Connect Unlimited Edition for System i 9.7 IBM DB2 Connect Unlimited Edition for System i 9.5 IBM DB2 Connect Unlimited Edition for System i 9.1 IBM DB2 Connect Unlimited Edition for System i 10.1 IBM DB2 Connect Enterprise Edition 9.7 IBM DB2 Connect Enterprise Edition 9.5 IBM DB2 Connect Enterprise Edition 9.1 IBM DB2 Connect Enterprise Edition 10.1 IBM DB2 Connect Application Server Edition 9.7 IBM DB2 Connect Application Server Edition 9.5 IBM DB2 Connect Application Server Edition 9.1 IBM DB2 Connect Application Server Edition 10.1 IBM DB2 Advanced Enterprise Server Edition 9.7 IBM DB2 Advanced Enterprise Server Edition 9.5 IBM DB2 Advanced Enterprise Server Edition 9.1 IBM DB2 Advanced Enterprise Server Edition 10.1 |
| Not Vulnerable: | |
Discussion
IBM DB2 and DB2 Connect Audit Facility Local Privilege Escalation Vulnerability
IBM DB2 and DB2 Connect are prone to a local privilege-escalation vulnerability.
Exploiting this issue allows local attackers to gain DB2 instance with owner level privileges.
The following products are affected:
IBM DB2 Express Edition
IBM DB2 Workgroup Server Edition
IBM DB2 Enterprise Server Edition
IBM DB2 Advanced Enterprise Server Edition
IBM DB2 Connect Application Server Edition
IBM DB2 Connect Enterprise Edition
IBM DB2 Connect Unlimited Edition for System i
IBM DB2 Connect Unlimited Edition for System z
IBM DB2 and DB2 Connect are prone to a local privilege-escalation vulnerability.
Exploiting this issue allows local attackers to gain DB2 instance with owner level privileges.
The following products are affected:
IBM DB2 Express Edition
IBM DB2 Workgroup Server Edition
IBM DB2 Enterprise Server Edition
IBM DB2 Advanced Enterprise Server Edition
IBM DB2 Connect Application Server Edition
IBM DB2 Connect Enterprise Edition
IBM DB2 Connect Unlimited Edition for System i
IBM DB2 Connect Unlimited Edition for System z
Exploit / POC
IBM DB2 and DB2 Connect Audit Facility Local Privilege Escalation Vulnerability
Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Currently, we are not aware of any exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution / Fix
IBM DB2 and DB2 Connect Audit Facility Local Privilege Escalation Vulnerability
Solution:
Updates are available. Please see the references or vendor advisory for more information.
Solution:
Updates are available. Please see the references or vendor advisory for more information.
References
IBM DB2 and DB2 Connect Audit Facility Local Privilege Escalation Vulnerability
References:
References: