Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
ibmIBM231AA96E28ABF1AA3054D8F7042B4A5F88BED711874A86610758981D341E9C8C
HistorySep 08, 2022 - 6:57 a.m.

Security Bulletin: Multiple vulnerabilities found in IBM DB2 which is shipped with IBM® Intelligent Operations Center(CVE-2021-38931, CVE-2021-29678, CVE-2021-20373, CVE-2021-39002, CVE-2021-38926)

2022-09-0806:57:06
www.ibm.com
17
ibm db2
information disclosure
unauthorized access
weak cryptography
upgrade
ibm intelligent operations center version 5.2.3

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

EPSS

0.001

Percentile

46.4%

JSON

Summary

Multiple vulnerabilities have been identified in DB2 which is shipped with IBM® Intelligent Operations Center. Information about these vulnerabilities affecting IBM® Intelligent Operations Center have been published and addressed the applicable CVEs.

Vulnerability Details

CVEID:CVE-2021-38931
**DESCRIPTION:**IBM Db2 for Linux, UNIX and Windows (includes DB2 Connect Server) 11.1, and 11.5 is vulnerable to an information disclosure as a result of a connected user having indirect read access to a table where they are not authorized to select from. IBM X-Force ID: 210418.
CVSS Base score: 6.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/210418 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-29678
**DESCRIPTION:**IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a user with DBADM authority to access other databases and read or modify files. IBM X-Force ID: 199914.
CVSS Base score: 8.7
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/199914 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N)

CVEID:CVE-2021-20373
**DESCRIPTION:**IBM Db2 9.7, 10.1, 10.5, 11.1, and 11.5 may be vulnerable to an Information Disclosure when using the LOAD utility as under certain circumstances the LOAD utility does not enforce directory restrictions. IBM X-Force ID: 199521.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/195521 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-39002
**DESCRIPTION:**IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information.
CVSS Base score: 5.9
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/213217 for the current score.
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)

CVEID:CVE-2021-38926
**DESCRIPTION:**IBM Db2 for Linux, UNIX and Windows (includes Db2 Connect Server) 9.7, 10.1, 10.5, 11.1, and 11.5 could allow a local user to gain privileges due to allowing modification of columns of existing tasks. IBM X-Force ID: 210321.
CVSS Base score: 5.5
CVSS Temporal Score: See: https://exchange.xforce.ibmcloud.com/vulnerabilities/210321 for the current score.
CVSS Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)

Affected Products and Versions

Affected Product(s) Version(s)
Intelligent Operations Center (IOC) 5.1.0, 5.1.0.2, 5.1.0.3, 5.1.0.4, 5.1.0.6, 5.2, 5.2.1, 5.2.2

Remediation/Fixes

The recommended solution is to apply an interim fix that contains the fix for this issue as soon as practical.

Download the IBM Intelligent Operations Center Version 5.2.3 is an upgrade to IBM Intelligent Operations Center Version 5.2.2 through IBM Intelligent Operations Center Version 5.2 from the following link:

IBM Intelligent Operations Center Version 5.2.3

Installation instructions for the fix are included in the readme document that is in the fix package.

Workarounds and Mitigations

None

Affected configurations

Vulners
Node
ibmintelligent_operations_centerMatch5.1.0
OR
ibmintelligent_operations_centerMatch5.1.0.2
OR
ibmintelligent_operations_centerMatch5.1.0.3
OR
ibmintelligent_operations_centerMatch5.1.0.4
OR
ibmintelligent_operations_centerMatch5.1.0.6
OR
ibmintelligent_operations_centerMatch5.2
OR
ibmintelligent_operations_centerMatch5.2.1
OR
ibmintelligent_operations_centerMatch5.2.2
VendorProductVersionCPE
ibmintelligent_operations_center5.1.0cpe:2.3:a:ibm:intelligent_operations_center:5.1.0:*:*:*:*:*:*:*
ibmintelligent_operations_center5.1.0.2cpe:2.3:a:ibm:intelligent_operations_center:5.1.0.2:*:*:*:*:*:*:*
ibmintelligent_operations_center5.1.0.3cpe:2.3:a:ibm:intelligent_operations_center:5.1.0.3:*:*:*:*:*:*:*
ibmintelligent_operations_center5.1.0.4cpe:2.3:a:ibm:intelligent_operations_center:5.1.0.4:*:*:*:*:*:*:*
ibmintelligent_operations_center5.1.0.6cpe:2.3:a:ibm:intelligent_operations_center:5.1.0.6:*:*:*:*:*:*:*
ibmintelligent_operations_center5.2cpe:2.3:a:ibm:intelligent_operations_center:5.2:*:*:*:*:*:*:*
ibmintelligent_operations_center5.2.1cpe:2.3:a:ibm:intelligent_operations_center:5.2.1:*:*:*:*:*:*:*
ibmintelligent_operations_center5.2.2cpe:2.3:a:ibm:intelligent_operations_center:5.2.2:*:*:*:*:*:*:*

Related

ibm 22
nessus 8
prion 5
cve 5
nvd 5
cnvd 5
cvelist 5
ibm
ibm
Security Bulletin: Multiple vulnerabilities in IBM DB2 affect IBM Operations Analytics Predictive Insights
2022-03-16 12:11:34
Security Bulletin: Multiple security vulnerabilities have been identified in IBM DB2 shipped with IBM Maximo Asset Management
2022-01-12 22:47:20
Security Bulletin: DB2 bundled with IBM i2 Analyze is affected by multiple vulnerabilities (CVE-2021-38931, CVE-2021-29678, CVE-2021-20373, CVE-2021-39002, CVE-2021-38926)
2021-12-13 16:47:46
nessus
nessus
IBM DB2 9.7 < 9.7 FP11 40985 / 10.1 < 10.1 FP6 40986 / 10.5 < 10.5 FP11 40988 / 11.1 < 11.1.4 FP6 41025 / 11.5 < 11.5.7 Information Disclosure (Windows)
2022-02-08 00:00:00
IBM DB2 9.7 < 9.7.0 FP11 40985 / 10.1 < 10.1.0 FP6 40986 / 10.5 < 10.5.0 FP11 40988 / 11.1 < 11.1.4 FP6 40997 / 11.5 < 11.5.7 Information Disclosure (Unix)
2022-02-08 00:00:00
IBM DB2 11.1 < 11.1.4 FP 6 41025 / 11.5 < 11.5.7 Information Disclosure (Windows)
2022-01-28 00:00:00
prion
prion
Code injection
2021-12-09 17:15:00
Design/Logic Flaw
2021-12-09 17:15:00
Information disclosure
2021-12-09 17:15:00
cve
cve
CVE-2021-38926
2021-12-09 17:15:07
CVE-2021-29678
2021-12-09 17:15:07
CVE-2021-38931
2021-12-09 17:15:07
nvd
nvd
CVE-2021-39002
2021-12-09 17:15:07
CVE-2021-38926
2021-12-09 17:15:07
CVE-2021-38931
2021-12-09 17:15:07
cnvd
cnvd
IBM Db2 Information Disclosure Vulnerability (CNVD-2022-08971)
2021-12-13 00:00:00
IBM Db2 Access Control Error Vulnerability
2021-12-12 00:00:00
IBM Db2 Elevation of Privilege Vulnerability (CNVD-2021-99672)
2021-12-12 00:00:00
cvelist
cvelist
CVE-2021-38926
2021-12-09 17:00:27
CVE-2021-29678
2021-12-09 17:00:26
CVE-2021-39002
2021-12-09 17:00:32

CVSS2

5.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:P/A:N

CVSS3

8.7

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

CHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N

EPSS

0.001

Percentile

46.4%

JSON
Related for 231AA96E28ABF1AA3054D8F7042B4A5F88BED711874A86610758981D341E9C8C
ibm22nessus8prion5cve5nvd5cnvd5cvelist5