CVE-2008-3855

Unspecified vulnerability in the DB2 Administration Server DAS in the Core DAS function component in IBM DB2 9.1 before Fixpak 5 allows local users to gain privileges, aka a "FILE CREATION VULNERABILITY." NOTE: this may be the same as CVE-2007-5664...

CVE-2008-3857

CVE-2008-3857 affects IBM DB2 9.1 Base Service Utilities; before Fixpak 5, it may retain the cleartext password in memory after the connection is established, potentially allowing local users to read sensitive data from a memory dump. Exploitation details are not provided in the available documen...

CVE-2008-3858

The CVE-2008-3858 entry concerns IBM DB2 9.1’s Downlevel DB2RA Support component. A crafted CONNECT data stream simulating a V7 client connect request can remotely cause an instance crash (DoS) prior to Fixpak 4a. The description does not provide details on affected subcomponents beyond this, nor...

CVE-2008-3853

CVE-2008-3853 is a buffer overflow in the IBM DB2 DAS (Database Administration Server) component that affected multiple DB2 releases. Connected documents show the root cause as a memory corruption/overflow in the DAS handling of remote administration requests, allowing a remote attacker to crash ...

CVE-2008-3856

The CVE-2008-3856 entry concerns IBM DB2 on Unix/Linux where the db2fmp process does not change its ownership for DB2 versions 8 before FP17, 9.1 before FP5, and 9.5 before FP1. The underlying cause is stated as an ownership handling issue, with unknown impact and attack vectors; the provided doc...

CVE-2008-3858

The Downlevel DB2RA Support component in IBM DB2 9.1 before Fixpak 4a allows remote attackers to cause a denial of service instance crash via a crafted CONNECT data stream that simulates a V7 client connect request...

CVE-2008-3855

CVE-2008-3855 describes an unspecified local privilege-escalation vulnerability in IBM DB2 Universal Database 9.1’s DB2 Administration Server (DAS) Core DAS before Fixpak 5. It is a FILE CREATION vulnerability that can allow escalation by manipulating files used during initialization; some source...

CVE-2008-3852

CVE-2008-3852 affects IBM DB2 Server via the CLR stored procedure deployment feature of IBM Database Add-Ins for Visual Studio. A vulnerability in IBM DB2 9.1 before Fixpak 5 and 9.5 before Fixpak 2 allows remote authenticated users to execute arbitrary code through unknown vectors in the CLR dep...

CVE-2008-3854

CVE-2008-3854 affects IBM DB2 UDB (DB2 9.1 before Fix Pak 5 and 9.5 before Fixpak 1). The vulnerability consists of multiple stack-based buffer overflows in XML-related SQL semantics (XMLQUERY, XMLEXISTS, XMLTABLE) and the sqlrlaka function, allowing remote attackers to cause a denial of service ...

IBM DB2 9.5 < Fix Pack 2 Multiple Vulnerabilities

The installation of IBM DB2 9.5 running on the remote host does not have Fix Pack 2 applied. It is, therefore, affected by the following issues : - DB2 does not mark inoperative or drop views and triggers if the definer cannot maintain the objects IZ22307. - Password-related connection string...

Unfixed XSS vulnerability at db2.photoresearchers.com

Security researcher JoCk3r, has submitted on 20/08/2008 a cross-site-scripting XSS vulnerability affecting db2.photoresearchers.com, which at the time of submission ranked 962226 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/10/2008. It is...

Default Password (db2admin) for 'db2admin' Account on Windows

The 'db2admin' account on the remote Windows host uses a known password. This account may have been created during installation of DB2 for use when managing the application, and it likely belongs to the Local Administrators group. Note that while the DB2 installation no longer uses a default...

IBM DB2 9.5 < 9.5 Fix Pack 1 Multiple Vulnerabilities

Binary data 4612.prm...

IBM DB2 < 9.5 Fix Pack 1 Multiple Vulnerabilities

The installation of IBM DB2 9.5 running on the remote host does not have any Fix Packs applied. It is, therefore, affected by one or more of the following issues : - There is a security vulnerability in the 'NNSTAT' procedure on Windows platforms only that allows low- privileged users to overwrit...

[SECURITY] Fedora 9 Update: gallery2-2.2.5-1.fc9

The base Gallery 2 installation - the equivalent of upstream's -minimal package. This package requires a database to be operational. Acceptable database backends include MySQL v 3.x, MySQL v 4.x, PostgreSQL v 7.x, PostgreSQL v 8.x, Oracle 9i, Oracle 10g, DB2, and MS SQL Server. All given package...

[SECURITY] Fedora 8 Update: gallery2-2.2.5-1.fc8

The base Gallery 2 installation - the equivalent of upstream's -minimal package. This package requires a database to be operational. Acceptable database backends include MySQL v 3.x, MySQL v 4.x, PostgreSQL v 7.x, PostgreSQL v 8.x, Oracle 9i, Oracle 10g, DB2, and MS SQL Server. All given package...

IBM DB2数据库9.1 Fixpak 5版本修复多个漏洞

BUGTRAQ ID: 29601 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。 IBM DB2数据库的9.1 Fixpak 5之前版本中存在多个安全漏洞，允许恶意的本地用户获得权限提升。 1 Visual Studio的IBM数据库插件的CLR存储过程部署中存在安全漏洞。 2 SQLRLAKA中存在栈溢出漏洞。 3 管理服务器创建文件的方式存在漏洞，允许恶意的本地用户获得root用户权限。 4...

IBM DB2 < 9 Fix Pack 5 Multiple Vulnerabilities

According to its version, the IBM DB2 server running on the remote host is affected by one or more of the following issues : - There is an unspecified security vulnerability related to a 'DB2FMP' process. IZ20352 - On Windows, the 'DB2FMP' process is running with OS privileges. JR30026 - The CLR...

Code injection

The NNSTAT aka SYSPROC.NNSTAT procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter...

CVE-2008-1998

The NNSTAT aka SYSPROC.NNSTAT procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter...