Security Bulletin: Information Disclosure vulnerability affects IBM® DB2® LUW (CVE-2017-1150)

Summary When a table is renamed and a new table is created with the old name, users who had access on the old table may be able to access the new table. Vulnerability Details A user may incorrectly acquire privileges on a table if the table is created with the same name as a previously renamed...

CVE-2017-1150

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables that they should not be permitted to view. IBM Reference : 1999515...

CVE-2017-1150

CVE-2017-1150 affects IBM DB2 for Linux, UNIX and Windows (including DB2 Connect Server) across versions 10.1, 10.5, and 11.1. The root cause is a stale user authorization cache during RENAME TABLE, which can allow an authenticated user with specialized access to view a newly created table under ...