CVE-2008-1681

Unspecified vulnerability in IBM DB2 Content Manager before 8.3 FP8 has unknown impact and attack vectors related to the AllowedTrustedLogin privilege...

CVE-2008-1681

Technical details about CVE-2008-1681 are not provided in the supplied documents; no affected products, vulnerable components, impact, or fixes are disclosed. Monitor for updates from official advisories.

DB2 Monitoring Console文件上传和非授权访问漏洞

BUGTRAQ ID: 28253 DB2 Monitoring Console是轻型的基于web的DB2控制台。 DB2 Monitoring Console中的安全漏洞允许向运行该应用的Web服务器上传文件；如果用户受骗跟随了恶意链接的话，还可能导致访问当前用户所连接的数据库。成功攻击要求知道DB2 MC Web服务器的地址。 DB2 Monitoring Console DB2 Monitoring Console 2.2.18 DB2 Monitoring Console ---------------------- 目前厂商已经发布了升级补丁以修复这个安全问题，请到厂商的主页下...

IBM DB2 Universal Database DAS缓冲区溢出漏洞

BUGTRAQ ID: 27681 CVECAN ID: CVE-2007-3676 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。 DB2管理服务器（DAS）在处理某些远程管理请求时会使用远程客户端所提供的32位指针值。如果提供了特制的地址值的话，攻击者就可以触发缓冲区溢出，强制程序访问无效的内存地址。 成功攻击允许攻击者导致服务崩溃或执行任意代码。无需认证凭据便可利用这个漏洞，但必须要在TCP 523端口上与DAS创建TCP会话。 IBM DB2...

IBM DB2数据库db2db本地权限提升漏洞

BUGTRAQ ID: 27680 CVECAN ID: CVE-2007-5757 IBM DB2是一个大型的商业关系数据库系统，面向电子商务、商业资讯、内容管理、客户关系管理等应用，可运行于AIX、HP-UX、Linux、Solaris、Windows等系统。 在设置DB2INSTANCE环境变量的时候，libdb2库会使用相关用户的目录而不是DB2例程目录，这会允许本地非特权用户控制一些set-uid root二进制程序所操作的目录结构。...

CVE-2007-5757

Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database UDB 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library. NOTE: this might be the same issue as...

Design/Logic Flaw

Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database UDB 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library. NOTE: this might be the same issue as...

CVE-2007-3676

IBM DB2 Universal Database UDB Administration Server DAS 8 before Fix Pack 16 and 9 before Fix Pack 4 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via modified pointer values in unspecified remote administration requests, which triggers memory...

CVE-2007-3676

IBM DB2 Universal Database UDB Administration Server DAS 8 before Fix Pack 16 and 9 before Fix Pack 4 allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via modified pointer values in unspecified remote administration requests, which triggers memory...

CVE-2007-5757

The CVE-2007-5757 issue concerns IBM DB2 UDB and specifically the db2pd component. A untrusted search path allows a local user to gain root privileges by manipulating the DB2INSTANCE environment variable to point to a malicious library. Affected versions are IBM DB2 UDB 8 before FixPak 16 and 9 b...

CVE-2007-5757

Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database UDB 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library. NOTE: this might be the same issue as...

CVE-2007-3676

CVE-2007-3676 concerns IBM DB2 UDB DAS prior to Fix Pack 16 (DAS 8.x) and Fix Pack 4 (DAS 9.x). The vulnerability allows a remote attacker to crash the DAS service or potentially execute arbitrary code by sending specially crafted remote administration requests that modify pointer values, trigger...

CVE-2008-0696

IBM DB2 UDB before 8.2 Fixpak 16 does not properly check authorization for the ALTER TABLE statement, which has unknown impact and attack vectors...

Design/Logic Flaw

Unspecified vulnerability in DB2PD in IBM DB2 UDB before 8.2 Fixpak 16 allows local users to gain root privileges via unspecified vectors...

CVE-2008-0698

Buffer overflow in the DAS server in IBM DB2 UDB before 8.2 Fixpak 16 has unknown attack vectors, and an impact probably involving "invalid memory access."...

CVE-2008-0699

Unspecified vulnerability in the ADMINSPC procedure SYSPROC.ADMINSPC in IBM DB2 UDB before 8.2 Fixpak 16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unspecified attack vectors...

Buffer overflow

Buffer overflow in the DAS server in IBM DB2 UDB before 8.2 Fixpak 16 has unknown attack vectors, and an impact probably involving "invalid memory access."...

Code injection

Unspecified vulnerability in the ADMINSPC procedure SYSPROC.ADMINSPC in IBM DB2 UDB before 8.2 Fixpak 16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unspecified attack vectors...

Authorization

IBM DB2 UDB before 8.2 Fixpak 16 does not properly check authorization for the ALTER TABLE statement, which has unknown impact and attack vectors...

CVE-2008-0699

Unspecified vulnerability in the ADMINSPC procedure SYSPROC.ADMINSPC in IBM DB2 UDB before 8.2 Fixpak 16, 9.1 before FP4a, and 9.5 before FP1 allows remote authenticated users to execute arbitrary code via unspecified attack vectors...