Security Bulletin: Security vulnerabilities have been identified in IBM Db2 shipped with Predictive Maintenance and Quality (CVE-2018-1897, CVE-2018-1723)

Summary IBM DB2 is shipped with Predictive Maintenance and Quality. Information about a security vulnerability affecting IBM DB2 has been published in a security bulletin. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes section Affected Products and Versions...

Security Bulletin: IBM® DB2® contains a denial of service vulnerability in scalar functions (CVE-2018-1977)

Summary IBM DB2 contains a denial of service vulnerability on Linux System z® platform. A remote, authenticated DB2 user could exploit this vulnerability by executing a specially-crafted SQL statement with the TRUNCATE scalar functions. This could result in a DB2 server crash; if so, the server...

Security Bulletin: Security vulnerabilities have been identified in IBM DB2 shipped with IBM Maximo Asset Management

Summary IBM DB2 is shipped as a component of IBM Maximo Asset Management. Information about security vulnerabilities affecting IBM DB2 have been published in security bulletins. Vulnerability Details CVEID: CVE-2018-1857 DESCRIPTION: IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server...

Security Bulletin: Multiple vulnerabilities have been identified in DB2 that affect the IBM Performance Management product

Summary DB2 contains several vulnerabilities which can affect the IBM Performance Management product. Some of the information about security vulnerabilities affecting DB2 has been published in security bulletins. Vulnerability Details Relevant CVE Information: CVEID: CVE-2018-1711 DESCRIPTION: IB...

CVE-2018-1897

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 152462...

Stack overflow

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 152462...

CVE-2018-1897

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 152462...

CVE-2018-1897

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5., and 11.1 db2pdcfg is vulnerable to a stack based buffer overflow, caused by improper bounds checking which could allow an attacker to execute arbitrary code. IBM X-Force ID: 152462...

CVE-2018-1897

Summary: CVE-2018-1897 affects IBM Db2 db2pdcfg across multiple DB2 LUW releases (9.7, 10.1, 10.5, 11.1). It is caused by a stack-based buffer overflow due to improper bounds checking, potentially allowing local attackers to execute arbitrary code. Impact (from sources): local code execution with...

Security Bulletin: IBM® Db2®'s RCAC rules are not being enforced by CTAS sub-select statements (CVE-2018-1857).

Summary Db2's Row and Column Access Control RCAC rules are not being enforced when creating a table using AS CTAS sub-select statements. RCAC is not enforced when Db2 uses the 'WITH DATA' clause to select and insert data into the target table. Vulnerability Details CVEID: CVE-2018-1857 DESCRIPTIO...

Security Bulletin: IBM® Db2® LUW on AIX and Linux Affected by a Vulnerability in IBM® Spectrum Scale (CVE-2018-1723).

Summary Db2 LUW is affected by a vulnerability in IBM® Spectrum Scale Version 4.1.x and 4.2.x that is used by DB2® pureScale™ Feature on AIX and Linux. IBM Spectrum Scale is previously known as General Parallel File System GPFS. Vulnerability Details CVEID: CVE-2018-1723 DESCRIPTION: IBM Spectrum...

Security Bulletin: Multiple vulnerabilities in IBM Java SDK and IBM Java Runtime affect IBM® Db2®.

Summary There are multiple vulnerabilities in IBM® Runtime Environment Java™ Version 6.0.16.65 and earlier, 6.1.8.65 and earlier, 7.0.10.25 and earlier, 7.1.4.25 and earlier, 8.0.5.17 and earlier used by IBM® Db2®. These issues were disclosed as part of the IBM Java SDK updates in August 2018...

Automatic SQL injection and database takeover tool: sqlmap

sqlmap is an open source penetration testing tool that automates the process of detecting and exploiting SQL injection flaws and taking over of database servers. It comes with a powerful detection engine, many niche features for the ultimate penetration tester and a broad range of switches lastin...

Design/Logic Flaw

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 149640...

CVE-2018-1834

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 contains a vulnerability that could allow a local user to escalate their privileges to root through a symbolic link attack. IBM X-Force ID: 150511...

CVE-2018-1857

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 11.1 could allow a user to bypass FGAC control and gain access to data they shouldn't be able to see. IBM X-Force ID: 151155...

CVE-2018-1780

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 could allow a local db2 instance owner to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148803...

CVE-2018-1802

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 binaries load shared libraries from an untrusted path potentially giving low privilege user full access to the DB2 instance account by loading a malicious shared library. IBM X-Force ID: 149640...

Code injection

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 could allow a local unprivileged user to overwrite files on the system which could cause damage to the database. IBM X-Force ID: 149429...

Code injection

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 could allow a local user to obtain root access by exploiting a symbolic link attack to read/write/corrupt a file that they originally did not have permission to access. IBM X-Force ID: 148804...