IBM DB2 Information Disclosure and Credential Exposure (7250484) (Windows)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(276921);
  script_version("1.4");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/04/08");

  script_cve_id("CVE-2025-36131");
  script_xref(name:"IAVB", value:"2025-B-0187-S");

  script_name(english:"IBM DB2 Information Disclosure and Credential Exposure (7250484) (Windows)");

  script_set_attribute(attribute:"synopsis", value:
"The remote database server is affected by a information disclosure and credential exposure vulnerability");
  script_set_attribute(attribute:"description", value:
"According to its self-reported version number, IBM Db2 on Windows may be affected by a vulnerability:

  - IBM Db2 11.1.0 through 11.1.4.7, 11.5.0 through 11.5.9, and 12.1.0 through 12.1.3 for Linux, UNIX and 
    Windows (includes Db2 Connect Server) clpplus command exposes user credentials to the terminal which 
    could be obtained by a third party with physical access to the system. (CVE-2025-36131)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  script_set_attribute(attribute:"see_also", value:"https://www.ibm.com/support/pages/node/7250484");
  script_set_attribute(attribute:"solution", value:
"Apply the appropriate IBM DB2 Fix Pack or Special Build based on the most recent fix pack level for your branch.");
  script_set_attribute(attribute:"agent", value:"windows");
  script_set_cvss_base_vector("CVSS2#AV:L/AC:L/Au:N/C:C/I:N/A:N");
  script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
  script_set_cvss3_base_vector("CVSS:3.0/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N");
  script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2025-36131");

  script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
  script_set_attribute(attribute:"exploit_available", value:"false");

  script_set_attribute(attribute:"vuln_publication_date", value:"2025/11/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2025/11/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2025/11/26");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:db2");
  script_set_attribute(attribute:"stig_severity", value:"I");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Databases");

  script_copyright(english:"This script is Copyright (C) 2025-2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("db2_and_db2_connect_installed.nbin");
  script_require_keys("SMB/db2/Installed");

  exit(0);
}

include('vcf_extras_db2.inc');

get_kb_item_or_exit('SMB/db2/Installed');
var app_info = vcf::ibm_db2::get_app_info();

var constraints = [
  {'min_version':'11.1', 'fixed_version':'11.1.4070.1733', 'fixed_display':'11.1.4070.1733 Special Build 41620'},
  {'min_version':'11.5', 'fixed_version':'11.5.9000.352', 'fixed_display':'11.5.9000.352 Special Build 66394 or Special Build 69673'},
  {'min_version':'12.1', 'fixed_version':'12.1.1000.77', 'fixed_display':'12.1.2000.229 Special Build 70120'},
];
vcf::ibm_db2::check_version_and_report(app_info:app_info, constraints:constraints, severity:SECURITY_WARNING);