Security Bulletin: IBM® Db2®'s RCAC rules are not being enforced by CTAS sub-select statements (CVE-2018-1857).

Summary

Db2’s Row and Column Access Control (RCAC) rules are not being enforced when creating a table using AS (CTAS) sub-select statements. RCAC is not enforced when Db2 uses the ‘WITH DATA’ clause to select and insert data into the target table.

Vulnerability Details

CVEID: CVE-2018-1857 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) could allow a user to bypass FGAC control and gain access to data they shouldn’t be able to see.
CVSS Base Score: 4.8
CVSS Temporal Score: See <https://exchange.xforce.ibmcloud.com/vulnerabilities/151155&gt; for the current score
CVSS Environmental Score*: Undefined
CVSS Vector: (CVSS:3.0/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:N/A:N)

Affected Products and Versions

All fix pack levels of IBM Db2 V11.1 editions on all platforms are affected.

Remediation/Fixes

The recommended solution is to apply the appropriate fix for this vulnerability.

FIX:

The fix for DB2 release V11.1 is in V11.1.4.4, available for download from Fix Central.

IT26595

|

<http://www.ibm.com/support/docview.wss?uid=ibm10741687&gt;

Workarounds and Mitigations

None.