IBM DB2 9.5 < Fix Pack 2 Multiple Vulnerabilities

The installation of IBM DB2 9.5 running on the remote host does not have Fix Pack 2 applied. It is, therefore, affected by the following issues : - DB2 does not mark inoperative or drop views and triggers if the definer cannot maintain the objects IZ22307. - Password-related connection string...

Unfixed XSS vulnerability at db2.photoresearchers.com

Security researcher JoCk3r, has submitted on 20/08/2008 a cross-site-scripting XSS vulnerability affecting db2.photoresearchers.com, which at the time of submission ranked 962226 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 02/10/2008. It is...

Default Password (db2admin) for 'db2admin' Account on Windows

The 'db2admin' account on the remote Windows host uses a known password. This account may have been created during installation of DB2 for use when managing the application, and it likely belongs to the Local Administrators group. Note that while the DB2 installation no longer uses a default...

IBM DB2 9.5 < 9.5 Fix Pack 1 Multiple Vulnerabilities

Binary data 4612.prm...

IBM DB2 < 9.5 Fix Pack 1 Multiple Vulnerabilities

The installation of IBM DB2 9.5 running on the remote host does not have any Fix Packs applied. It is, therefore, affected by one or more of the following issues : - There is a security vulnerability in the 'NNSTAT' procedure on Windows platforms only that allows low- privileged users to overwrit...

[SECURITY] Fedora 9 Update: gallery2-2.2.5-1.fc9

The base Gallery 2 installation - the equivalent of upstream's -minimal package. This package requires a database to be operational. Acceptable database backends include MySQL v 3.x, MySQL v 4.x, PostgreSQL v 7.x, PostgreSQL v 8.x, Oracle 9i, Oracle 10g, DB2, and MS SQL Server. All given package...

[SECURITY] Fedora 8 Update: gallery2-2.2.5-1.fc8

The base Gallery 2 installation - the equivalent of upstream's -minimal package. This package requires a database to be operational. Acceptable database backends include MySQL v 3.x, MySQL v 4.x, PostgreSQL v 7.x, PostgreSQL v 8.x, Oracle 9i, Oracle 10g, DB2, and MS SQL Server. All given package...

IBM DB2数据库9.1 Fixpak 5版本修复多个漏洞

BUGTRAQ ID: 29601 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。 IBM DB2数据库的9.1 Fixpak 5之前版本中存在多个安全漏洞，允许恶意的本地用户获得权限提升。 1 Visual Studio的IBM数据库插件的CLR存储过程部署中存在安全漏洞。 2 SQLRLAKA中存在栈溢出漏洞。 3 管理服务器创建文件的方式存在漏洞，允许恶意的本地用户获得root用户权限。 4...

IBM DB2 < 9 Fix Pack 5 Multiple Vulnerabilities

According to its version, the IBM DB2 server running on the remote host is affected by one or more of the following issues : - There is an unspecified security vulnerability related to a 'DB2FMP' process. IZ20352 - On Windows, the 'DB2FMP' process is running with OS privileges. JR30026 - The CLR...

Code injection

The NNSTAT aka SYSPROC.NNSTAT procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter...

CVE-2008-1997

Unspecified vulnerability in the ADMINSPC2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMINSPC issue is already covered by CVE-2008-0699...

CVE-2008-1998

The NNSTAT aka SYSPROC.NNSTAT procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter...

Code injection

Unspecified vulnerability in the ADMINSPC2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMINSPC issue is already covered by CVE-2008-0699...

CVE-2008-1998

The NNSTAT aka SYSPROC.NNSTAT procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter...

CVE-2008-1998

CVE-2008-1998 affects IBM DB2 prior to FP16 on 8.x, prior to FP4a on 9.1, and prior to FP1 on 9.5 (Windows). The NNSTAT (SYSPROC.NNSTAT) procedure can be abused by remote authenticated users to overwrite arbitrary files via the log file parameter. No explicit exploit details or in-the-wild status...

CVE-2008-1997

The CVE refers to an issue in IBM DB2’s SYSPROC.ADMIN_SP_C/ADMIN_SP_C2 procedures. Affects IBM DB2 UDB when running versions 8.0–8.0 FP15 (prior to FP16 on 8.x), 9.1 (prior to FP4a), and 9.5 (prior to FP1). Remote authenticated users may execute arbitrary code via unknown vectors due to the ADMIN...

CVE-2008-1997

Unspecified vulnerability in the ADMINSPC2 procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unknown vectors. NOTE: the ADMINSPC issue is already covered by CVE-2008-0699...

Buffer overflow

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service instance crash via a call to the 1 RECOVERJAR or 2 REMOVEJAR procedure with a...

CVE-2008-1966

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service instance crash via a call to the 1 RECOVERJAR or 2 REMOVEJAR procedure with a...

CVE-2008-1966

Multiple buffer overflows in the JAR file administration routines in the BSU JAVA subcomponent in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 allow remote authenticated users to cause a denial of service instance crash via a call to the 1 RECOVERJAR or 2 REMOVEJAR procedure with a...