Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM Maximo Asset Management (CVE-2018-1710, CVE-2018-1685, CVE-2018-1711)

Summary

IBM DB2 is shipped as a component of IBM Maximo Asset Management. Information about security vulnerabilities affecting IBM DB2 has been published in security bulletins.

Vulnerability Details

CVEID: CVE-2018-1710 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) tool db2licm is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution.
CVSS Base Score: 8.4
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/146364&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

CVEID: CVE-2018-1685 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 contains a vulnerability in db2cacpy that could allow a local user to read any file on the system. IBM X-Force ID: 145502.
CVSS Base Score: 6.2
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/145502&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2018-1711
DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, and 11.1 could allow a local user to to gain privileges due to allowing modificaiton of columns of existing tasks. IBM X-Force ID: 146369.
CVSS Base Score: 8.4
CVSS Temporal Score: <https://exchange.xforce.ibmcloud.com/vulnerabilities/146369&gt; for more information
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)

Affected Products and Versions

This vulnerability affects the following versions of the IBM Maximo Asset Management core product, and all other IBM Maximo Industry Solution and IBM Control Desk products, regardless of their own version, if they are currently installed on top of an affected IBM Maximo Asset Management. *

Maximo Asset Management core product affected versions:
Maximo Asset Management 7.6

Industry Solutions products affected if using an affected core version:
Maximo for Aviation
Maximo for Life Sciences
Maximo for Nuclear Power
Maximo for Oil and Gas
Maximo for Transportation
Maximo for Utilities

IBM Control Desk products affected if using an affected core version:
SmartCloud Control Desk
IBM Control Desk
Tivoli Integration Composer

• To determine the core product version, log in and view System Information. The core product version is the “Tivoli’s process automation engine” version. Please consult the Product Coexistence Matrix for a list of supported product combinations.

Remediation/Fixes

Please consult the following security bulletins for vulnerability details and information about fixes:

• Security Bulletin: Buffer overflow in IBM® Db2® tool db2licm (CVE-2018-1710)
• Security Bulletin: Privilege escalation in IBM® Db2® tool db2cacpy (CVE-2018-1685)
• Security Bulletin: Privilege escalation vulnerability affects IBM® Db2® Administrative Task Scheduler (CVE-2018-1711)