IBM DB2 GSKit Privilege Acquisition Vulnerability

IBM DB2 is a set of relational database management system of American IBM Company. The system is implemented in UNIX, Linux, IBM i, z/OS, and Windows server versions.GSKit is one of a set of security management tools for IBM products. A security vulnerability exists in GSKit in IBM DB2. An attack...

IBM DB2 9.7 < FP11 Special Build 37314 / 10.1 < FP6 Special Build 37313 / 10.5 < FP10 / 11.1.3 < FP3 JDBC Driver Unsafe Deserialization Local Privilege Escalation (Windows)

According to its version, the installation of IBM DB2 on the remote Windows host is either 9.7 prior to Fix Pack 11 Special Build 37314, 10.1 prior to Fix Pack 6 Special Build 37313, 10.5 prior to Fix Pack 10 , or 11.1.3 prior to Fix Pack 3. It is, therefore, affected by a local privilege...

IBM DB2 9.7 < FP11 Special Build 37314 / 10.1 < FP6 Special Build 37313 / 10.5 < FP10 Special Build 37311 / 11.1.3 < FP3 JDBC Driver Unsafe Deserialization Local Privilege Escalation (UNIX)

According to its version, the installation of IBM DB2 running on the remote host is either 9.7 prior to Fix Pack 11 Special Build 37314, 10.1 prior to Fix Pack 6 Special Build 37313, 10.5 prior to Fix Pack 10 Special Build 37311, or 11.1.3 prior to Fix Pack 3. It is, therefore, affected by a loca...

Code injection

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 duplicates the PRNG state across fork system calls when multiple ICC instances are loaded which could result in duplicate Session IDs and a risk of duplicate key material. IBM X-Force ID: 139071...

Code injection

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 contains several environment variables that a local attacker could overflow and cause a denial of service. IBM X-Force ID: 139072...

CVE-2017-1571

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 131853...

CVE-2018-1448

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 includes DB2 Connect Server contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140043...

Code injection

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 131853...

CVE-2018-1427

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 contains several environment variables that a local attacker could overflow and cause a denial of service. IBM X-Force ID: 139072...

CVE-2018-1428

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 139073...

Code injection

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 139073...

CVE-2017-1571

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 131853...

Design/Logic Flaw

IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 includes DB2 Connect Server contains a vulnerability that could allow a local user to overwrite arbitrary files owned by the DB2 instance owner. IBM X-Force ID: 140043...

CVE-2018-1428

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 139073...

CVE-2017-1677

CVE-2017-1677 affects IBM DB2 family via unsafe deserialization in the Data Server Driver for JDBC/SQLJ. The vulnerability occurs when the driver deserializes /tmp/connlicj.bin, enabling object injection and potentially arbitrary code execution depending on the classpath. Affected products/versio...

CVE-2018-1427

IBM GSKit IBM DB2 for Linux, UNIX and Windows 9.7, 10.1, 10.5, and 11.1 contains several environment variables that a local attacker could overflow and cause a denial of service. IBM X-Force ID: 139072...

CVE-2017-1571

IBM DB2 for Linux, UNIX and Windows includes DB2 Connect Server 9.7, 10.1, 10.5, and 11.1 uses weaker than expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM X-Force ID: 131853...

CVE-2017-1571

CVE-2017-1571 affects IBM DB2 for Linux, UNIX and Windows (including DB2 Connect Server) versions 9.7, 10.1, 10.5 and 11.1. The weakness is weaker-than-expected cryptographic algorithms that could allow an attacker to decrypt highly sensitive information. IBM’s IBM X-Force ID: 131853. Connected I...

CVE-2018-1426

CVE-2018-1426 affects IBM GSKit: it duplicates the PRNG state across fork() when multiple ICC instances load, risking duplicate Session IDs and key material. Documents confirm the vulnerability description and its association with GSKit in IBM products; however, a concrete, product-specific fixed...

CVE-2018-1428

CVE-2018-1428 is discussed in IBM GSKit-related security bulletins. The vulnerability arises from weaker-than-expected cryptographic algorithms in IBM GSKit, which could permit an attacker to decrypt highly sensitive information. The connected IBM documents assign a base score of 6.2 (CVSS v3) fo...