Lucene search
HistoryAug 28, 2008 - 5:41 p.m.
CVE-2008-3856
ibm
db2
routine infrastructure
privilege escalation
cve-2008-3856
nvd
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
6.1 Medium
AI Score
Confidence
Low
0.008 Low
EPSS
Percentile
82.1%
The routine infrastructure component in IBM DB2 8 before FP17, 9.1 before FP5, and 9.5 before FP1 on Unix and Linux does not change the ownership of the db2fmp process, which has unknown impact and attack vectors.
Affected configurations
Node
ibmdb2_universal_databaseRange≤8fp16aix
ORibmdb2_universal_databaseRange≤8fp16hp_ux
ORibmdb2_universal_databaseRange≤8fp16linux
ORibmdb2_universal_databaseRange≤8fp16solaris
ORibmdb2_universal_databaseRange≤9.1fp4aaix
ORibmdb2_universal_databaseRange≤9.1fp4ahp-ux
ORibmdb2_universal_databaseRange≤9.1fp4alinux
ORibmdb2_universal_databaseRange≤9.1fp4asolaris
ORibmdb2_universal_databaseMatch8fp1aix
ORibmdb2_universal_databaseMatch8fp1hp_ux
ORibmdb2_universal_databaseMatch8fp1linux
ORibmdb2_universal_databaseMatch8fp10aix
ORibmdb2_universal_databaseMatch8fp10hp_ux
ORibmdb2_universal_databaseMatch8fp10linux
ORibmdb2_universal_databaseMatch8fp10solaris
ORibmdb2_universal_databaseMatch8fp11aix
ORibmdb2_universal_databaseMatch8fp11hp_ux
ORibmdb2_universal_databaseMatch8fp11linux
ORibmdb2_universal_databaseMatch8fp11solaris
ORibmdb2_universal_databaseMatch8fp12aix
ORibmdb2_universal_databaseMatch8fp12hp_ux
ORibmdb2_universal_databaseMatch8fp12linux
ORibmdb2_universal_databaseMatch8fp12solaris
ORibmdb2_universal_databaseMatch8fp13aix
ORibmdb2_universal_databaseMatch8fp13hp_ux
ORibmdb2_universal_databaseMatch8fp13linux
ORibmdb2_universal_databaseMatch8fp13solaris
ORibmdb2_universal_databaseMatch8fp14aix
ORibmdb2_universal_databaseMatch8fp14hp_ux
ORibmdb2_universal_databaseMatch8fp14linux
ORibmdb2_universal_databaseMatch8fp14solaris
ORibmdb2_universal_databaseMatch8fp15aix
ORibmdb2_universal_databaseMatch8fp15hp_ux
ORibmdb2_universal_databaseMatch8fp15linux
ORibmdb2_universal_databaseMatch8fp15solaris
ORibmdb2_universal_databaseMatch8fp2aix
ORibmdb2_universal_databaseMatch8fp2hp_ux
ORibmdb2_universal_databaseMatch8fp2linux
ORibmdb2_universal_databaseMatch8fp2solaris
ORibmdb2_universal_databaseMatch8fp3aix
ORibmdb2_universal_databaseMatch8fp3hp_ux
ORibmdb2_universal_databaseMatch8fp3linux
ORibmdb2_universal_databaseMatch8fp3solaris
ORibmdb2_universal_databaseMatch8fp4aix
ORibmdb2_universal_databaseMatch8fp4hp_ux
ORibmdb2_universal_databaseMatch8fp4linux
ORibmdb2_universal_databaseMatch8fp4solaris
ORibmdb2_universal_databaseMatch8fp4aaix
ORibmdb2_universal_databaseMatch8fp4ahp_ux
ORibmdb2_universal_databaseMatch8fp4alinux
ORibmdb2_universal_databaseMatch8fp4asolaris
ORibmdb2_universal_databaseMatch8fp5aix
ORibmdb2_universal_databaseMatch8fp5hp_ux
ORibmdb2_universal_databaseMatch8fp5linux
ORibmdb2_universal_databaseMatch8fp5solaris
ORibmdb2_universal_databaseMatch8fp6aix
ORibmdb2_universal_databaseMatch8fp6hp_ux
ORibmdb2_universal_databaseMatch8fp6linux
ORibmdb2_universal_databaseMatch8fp6solaris
ORibmdb2_universal_databaseMatch8fp6aaix
ORibmdb2_universal_databaseMatch8fp6ahp_ux
ORibmdb2_universal_databaseMatch8fp6alinux
ORibmdb2_universal_databaseMatch8fp6asolaris
ORibmdb2_universal_databaseMatch8fp6baix
ORibmdb2_universal_databaseMatch8fp6bhp_ux
ORibmdb2_universal_databaseMatch8fp6blinux
ORibmdb2_universal_databaseMatch8fp6bsolaris
ORibmdb2_universal_databaseMatch8fp6caix
ORibmdb2_universal_databaseMatch8fp6chp_ux
ORibmdb2_universal_databaseMatch8fp6clinux
ORibmdb2_universal_databaseMatch8fp6csolaris
ORibmdb2_universal_databaseMatch8fp7aix
ORibmdb2_universal_databaseMatch8fp7hp_ux
ORibmdb2_universal_databaseMatch8fp7linux
ORibmdb2_universal_databaseMatch8fp7solaris
ORibmdb2_universal_databaseMatch8fp7aaix
ORibmdb2_universal_databaseMatch8fp7ahp_ux
ORibmdb2_universal_databaseMatch8fp7alinux
ORibmdb2_universal_databaseMatch8fp7asolaris
ORibmdb2_universal_databaseMatch8fp7baix
ORibmdb2_universal_databaseMatch8fp7bhp_ux
ORibmdb2_universal_databaseMatch8fp7blinux
ORibmdb2_universal_databaseMatch8fp7bsolaris
ORibmdb2_universal_databaseMatch8fp8aix
ORibmdb2_universal_databaseMatch8fp8hp_ux
ORibmdb2_universal_databaseMatch8fp8linux
ORibmdb2_universal_databaseMatch8fp8solaris
ORibmdb2_universal_databaseMatch8fp8aaix
ORibmdb2_universal_databaseMatch8fp8ahp_ux
ORibmdb2_universal_databaseMatch8fp8alinux
ORibmdb2_universal_databaseMatch8fp8asolaris
ORibmdb2_universal_databaseMatch8fp9aix
ORibmdb2_universal_databaseMatch8fp9hp_ux
ORibmdb2_universal_databaseMatch8fp9linux
ORibmdb2_universal_databaseMatch8fp9solaris
ORibmdb2_universal_databaseMatch8fp9aaix
ORibmdb2_universal_databaseMatch8fp9ahp_ux
ORibmdb2_universal_databaseMatch8fp9alinux
ORibmdb2_universal_databaseMatch8fp9asolaris
ORibmdb2_universal_databaseMatch8.0aix
ORibmdb2_universal_databaseMatch8.0hp_ux
ORibmdb2_universal_databaseMatch8.0linux
ORibmdb2_universal_databaseMatch8.0solaris
ORibmdb2_universal_databaseMatch9.1aix
ORibmdb2_universal_databaseMatch9.1hp_ux
ORibmdb2_universal_databaseMatch9.1linux
ORibmdb2_universal_databaseMatch9.1solaris
ORibmdb2_universal_databaseMatch9.1fp2aix
ORibmdb2_universal_databaseMatch9.1fp2hp-ux
ORibmdb2_universal_databaseMatch9.1fp2linux
ORibmdb2_universal_databaseMatch9.1fp2solaris
ORibmdb2_universal_databaseMatch9.1fp3aix
ORibmdb2_universal_databaseMatch9.1fp3hp-ux
ORibmdb2_universal_databaseMatch9.1fp3linux
ORibmdb2_universal_databaseMatch9.1fp3solaris
ORibmdb2_universal_databaseMatch9.1fp4aix
ORibmdb2_universal_databaseMatch9.1fp4hp-ux
ORibmdb2_universal_databaseMatch9.1fp4linux
ORibmdb2_universal_databaseMatch9.1fp4solaris
References
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v82/APARLIST.TXT
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT
secunia.com/advisories/29784
secunia.com/advisories/31787
www-01.ibm.com/support/docview.wss?uid=swg1IZ19155
www-1.ibm.com/support/docview.wss?uid=swg1IZ20350
www-1.ibm.com/support/docview.wss?uid=swg1IZ20352
www-1.ibm.com/support/docview.wss?uid=swg21255607
www.securityfocus.com/bid/29601
www.securityfocus.com/bid/31058
exchange.xforce.ibmcloud.com/vulnerabilities/45140
Related
cvelist
cvelist
CVE-2008-3856
2008-08-28 17:00:00
CVE-2008-6820
2009-06-03 20:35:00
prion
prion
Security feature bypass
2008-08-28 17:41:00
Code injection
2009-06-03 21:00:00
nvd
nvd
CVE-2008-3856
2008-08-28 17:41:00
CVE-2008-6820
2009-06-03 21:00:00
cve
cve
CVE-2008-6820
2009-06-03 21:00:00
nessus
nessus
IBM DB2 8 < Fix Pack 17 Multiple Vulnerabilities
2008-09-12 00:00:00
IBM DB2 < 9 Fix Pack 5 Multiple Vulnerabilities
2008-06-10 00:00:00
7.5 High
CVSS2
Attack Vector
NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
PARTIAL
Integrity Impact
PARTIAL
Availability Impact
PARTIAL
AV:N/AC:L/Au:N/C:P/I:P/A:P
6.1 Medium
AI Score
Confidence
Low
0.008 Low
EPSS
Percentile
82.1%
Related for CVE-2008-3856