{"id": "SECURITYVULNS:DOC:17837", "bulletinFamily": "software", "title": "iDefense Security Advisory 08.16.07: IBM DB2 Universal Database Multiple Race Condition Vulnerabilities", "description": "IBM DB2 Universal Database Multiple Race Condition Vulnerabilities\r\n\r\niDefense Security Advisory 08.16.07\r\nhttp://labs.idefense.com/intelligence/vulnerabilities/\r\nAug 16, 2007\r\n\r\nI. BACKGROUND\r\n\r\nIBM Corp.'s DB2 Universal Database product is a large database server\r\nproduct commonly used for high end databases. For more information,\r\nvisit the following URL.\r\n\r\nhttp://ibm.com/db2/\r\n\r\nII. DESCRIPTION\r\n\r\nLocal exploitation of multiple race condition vulnerabilities in IBM\r\nCorp.'s DB2 Universal Database could allow attackers to elevate\r\nprivileges to the superuser.\r\n\r\nThese vulnerabilities are due to insufficient checking being performed\r\nwhile handling files with elevated privileges. In each case, a race\r\ncondition exists between a check to see if an existing file is a\r\nsymbolic link and modifying it. By quickly and repeatedly removing and\r\nrecreating the file as a symbolic link, an attacker could modify\r\narbitrary files with root privileges.\r\n\r\nIII. ANALYSIS\r\n\r\nExploitation allows local attackers to gain root privileges.\r\n\r\nDepending on the specific vulnerability, the attacker may have little or\r\nno control over the contents of data written to the file. In most cases,\r\nthis does not significantly impact exploitation since file permissions\r\nallow the file to be written to by the attacker.\r\n\r\nIV. DETECTION\r\n\r\niDefense confirmed the existence of these vulnerabilities in version 9.1\r\nFix Pack 2 of IBM Corp.'s DB2 Universal Database installed on a Linux\r\nsystem. All prior versions, as well as builds for other UNIX-based\r\noperating systems, are suspected to be vulnerable.\r\n\r\nV. WORKAROUND\r\n\r\nSetting more strict permissions on the DB2 instance directory can help\r\nmitigate some of these vulnerabilities. Removing the setuid-bit from\r\nall programs included with DB2 can also help mitigate exposure. Note,\r\nthese configuration changes have not been thoroughly tested and may\r\ncause adverse behavior.\r\n\r\nVI. VENDOR RESPONSE\r\n\r\nIBM Corp. has addressed these vulnerabilities by releasing V9 Fix Pack 3\r\nand version V8 FixPak 15 of its Universal Database product. More\r\ninformation can be found at the following URLs.\r\n\r\nV8: http://www-1.ibm.com/support/docview.wss?uid=swg21256235\r\nV9: http://www-1.ibm.com/support/docview.wss?uid=swg21255572\r\n\r\nVII. CVE INFORMATION\r\n\r\nThe Common Vulnerabilities and Exposures (CVE) project has assigned the\r\nname CVE-2007-4270 to this issue. This is a candidate for inclusion in\r\nthe CVE list (http://cve.mitre.org/), which standardizes names for\r\nsecurity problems.\r\n\r\nVIII. DISCLOSURE TIMELINE\r\n\r\n03/22/2007 Initial vendor notification\r\n03/23/2007 Initial vendor response\r\n08/16/2007 Coordinated public disclosure\r\n\r\nIX. CREDIT\r\n\r\nThese vulnerabilities were discovered by an anonymous researcher and\r\nJoshua J. Drake (iDefense Labs).\r\n\r\nGet paid for vulnerability research\r\nhttp://labs.idefense.com/methodology/vulnerability/vcp.php\r\n\r\nFree tools, research and upcoming events\r\nhttp://labs.idefense.com/\r\n\r\nX. LEGAL NOTICES\r\n\r\nCopyright \u00a9 2007 iDefense, Inc.\r\n\r\nPermission is granted for the redistribution of this alert\r\nelectronically. It may not be edited in any way without the express\r\nwritten consent of iDefense. If you wish to reprint the whole or any\r\npart of this alert in any other medium other than electronically,\r\nplease e-mail customerservice@idefense.com for permission.\r\n\r\nDisclaimer: The information in the advisory is believed to be accurate\r\nat the time of publishing based on currently available information. Use\r\nof the information constitutes acceptance for use in an AS IS condition.\r\n There are no warranties with regard to this information. Neither the\r\nauthor nor the publisher accepts any liability for any direct,\r\nindirect, or consequential loss or damage arising from use of, or\r\nreliance on, this information.", "published": "2007-08-18T00:00:00", "modified": "2007-08-18T00:00:00", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:DOC:17837", "reporter": "Securityvulns", "references": [], "cvelist": ["CVE-2007-4270"], "type": "securityvulns", "lastseen": "2018-08-31T11:10:23", "edition": 1, "viewCount": 34, "enchantments": {"score": {"value": 6.9, "vector": "NONE", "modified": "2018-08-31T11:10:23", "rev": 2}, "dependencies": {"references": [{"type": "cve", "idList": ["CVE-2007-4270"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:8068"]}, {"type": "seebug", "idList": ["SSV:2138"]}, {"type": "nessus", "idList": ["DB2_9FP3.NASL"]}], "modified": "2018-08-31T11:10:23", "rev": 2}, "vulnersScore": 6.9}, "affectedSoftware": [], "immutableFields": [], "cvss2": {}, "cvss3": {}}

{"cve": [{"id": "CVE-2007-4270", "bulletinFamily": "NVD", "title": "CVE-2007-4270", "description": "Multiple race conditions in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain root privileges via a symlink attack on certain files.", "published": "2007-08-18T21:17:00", "modified": "2017-07-29T01:32:00", "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4270", "reporter": "cve@mitre.org", "references": ["http://secunia.com/advisories/26471", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY99261", "http://securitytracker.com/id?1018581", "http://www.vupen.com/english/advisories/2007/2912", "https://exchange.xforce.ibmcloud.com/vulnerabilities/36069", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98210", "http://www.attrition.org/pipermail/vim/2007-August/001765.html", "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=578", "http://www-1.ibm.com/support/docview.wss?uid=swg21255607", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "http://www.securityfocus.com/bid/25339"], "cvelist": ["CVE-2007-4270"], "type": "cve", "lastseen": "2021-04-21T20:36:29", "history": [{"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "9.1"}, {"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "8.0"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:ibm:db2_universal_database:9.1", "cpe:/a:ibm:db2_universal_database:8.0"], "cpe23": ["cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*", "versionEndIncluding": "8.0", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "versionEndIncluding": "9.1", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2007-4270"], "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["NVD-CWE-Other"], "description": "Multiple race conditions in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain root privileges via a symlink attack on certain files.", "edition": 6, "enchantments": {"dependencies": {"modified": "2021-02-02T05:31:25", "references": [{"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_9FP3.NASL"], "type": "nessus"}, {"idList": ["SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837"], "type": "securityvulns"}], "rev": 2}, "score": {"modified": "2021-02-02T05:31:25", "rev": 2, "value": 6.6, "vector": "NONE"}}, "extraReferences": [{"name": "db2-binaries-symlink(36069)", "refsource": "XF", "tags": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36069"}, {"name": "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "refsource": "CONFIRM", "tags": ["Patch"], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21255352"}, {"name": "20070816 IBM DB2 Universal Database Multiple Race Condition Vulnerabilities", "refsource": "IDEFENSE", "tags": [], "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=578"}, {"name": "[VIM] 20070821 Recent DB2 Vulnerabilities", "refsource": "MLIST", "tags": [], "url": "http://www.attrition.org/pipermail/vim/2007-August/001765.html"}, {"name": "25339", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/25339"}, {"name": "IY99261", "refsource": "AIXAPAR", "tags": [], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IY99261"}, {"name": "http://www-1.ibm.com/support/docview.wss?uid=swg21255607", "refsource": "CONFIRM", "tags": ["Patch"], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21255607"}, {"name": "1018581", "refsource": "SECTRACK", "tags": [], "url": "http://securitytracker.com/id?1018581"}, {"name": "26471", "refsource": "SECUNIA", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/26471"}, {"name": "IY98210", "refsource": "AIXAPAR", "tags": [], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98210"}, {"name": "ADV-2007-2912", "refsource": "VUPEN", "tags": [], "url": "http://www.vupen.com/english/advisories/2007/2912"}], "hash": "fe5abfac3b858fb55b7f536f132f451920e85bd065ef45ab4313dbbaf39f3125", "hashmap": [{"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "6b21b47957f43a1b3ca33a633a6637d7", "key": "cpe"}, {"hash": "abf842fdf7d486ef0ef4015250f1813d", "key": "cpeConfiguration"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b0671ec9efec47c462608bd6892c2395", "key": "href"}, {"hash": "5236b91902a09e689e0aae6ceeaf2acd", "key": "modified"}, {"hash": "8e1dda11a2a59822902431087165a840", "key": "description"}, {"hash": "d7ce86f4946e2f8ad0313fb8ca975a70", "key": "cvelist"}, {"hash": "2a4e43c4882b7c72b788a6b8f3c3e245", "key": "cvss2"}, {"hash": "78a7a5cbaf09985c14389298e454e7db", "key": "cwe"}, {"hash": "693b35bf6f5030e89ef1b487cb406a51", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "0e6d250ca0bdd50c0dfdef3f6e290de0", "key": "cpe23"}, {"hash": "a6ccbebe85ca6df634afd51e0875ab52", "key": "published"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "84aef925899d55ba908bf76bc2d7fbde", "key": "title"}, {"hash": "dc6f826fa9e7967b19bf39dd7cac1a30", "key": "extraReferences"}, {"hash": "014b9175e8508627a39cbaf662515236", "key": "affectedSoftware"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d5f1840e27443eb2d6a17b941080264e", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4270", "id": "CVE-2007-4270", "immutableFields": [], "lastseen": "2021-02-02T05:31:25", "modified": "2017-07-29T01:32:00", "objectVersion": "1.5", "published": "2007-08-18T21:17:00", "references": ["http://secunia.com/advisories/26471", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY99261", "http://securitytracker.com/id?1018581", "http://www.vupen.com/english/advisories/2007/2912", "https://exchange.xforce.ibmcloud.com/vulnerabilities/36069", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98210", "http://www.attrition.org/pipermail/vim/2007-August/001765.html", "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=578", "http://www-1.ibm.com/support/docview.wss?uid=swg21255607", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "http://www.securityfocus.com/bid/25339"], "reporter": "cve@mitre.org", "title": "CVE-2007-4270", "type": "cve", "viewCount": 3}, "different_elements": ["cpeConfiguration"], "edition": 6, "lastseen": "2021-02-02T05:31:25"}, {"bulletin": {"affectedSoftware": [{"name": "ibm db2_universal_database", "operator": "le", "version": "8.0"}, {"name": "ibm db2_universal_database", "operator": "le", "version": "9.1"}], "bulletinFamily": "NVD", "cpe": [], "cpe23": [], "cvelist": ["CVE-2007-4270"], "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["NVD-CWE-Other"], "description": "Multiple race conditions in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain root privileges via a symlink attack on certain files.", "edition": 1, "enchantments": {"dependencies": {"modified": "2019-05-29T18:09:01", "references": [{"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_9FP3.NASL"], "type": "nessus"}, {"idList": ["SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837"], "type": "securityvulns"}], "rev": 2}, "score": {"modified": "2019-05-29T18:09:01", "rev": 2, "value": 6.6, "vector": "NONE"}}, "hash": "7cc40b10db54afe0f6273a4e4ecf46efb894defe2b6f6a51c90a239e57ff6938", "hashmap": [{"hash": "f0a38998087b9f9fe483f484cd6e8aa9", "key": "affectedSoftware"}, {"hash": "b0671ec9efec47c462608bd6892c2395", "key": "href"}, {"hash": "5236b91902a09e689e0aae6ceeaf2acd", "key": "modified"}, {"hash": "8e1dda11a2a59822902431087165a840", "key": "description"}, {"hash": "d7ce86f4946e2f8ad0313fb8ca975a70", "key": "cvelist"}, {"hash": "2a4e43c4882b7c72b788a6b8f3c3e245", "key": "cvss2"}, {"hash": "78a7a5cbaf09985c14389298e454e7db", "key": "cwe"}, {"hash": "693b35bf6f5030e89ef1b487cb406a51", "key": "references"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe23"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "a6ccbebe85ca6df634afd51e0875ab52", "key": "published"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "84aef925899d55ba908bf76bc2d7fbde", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d5f1840e27443eb2d6a17b941080264e", "key": "cvss"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cpe"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4270", "id": "CVE-2007-4270", "lastseen": "2019-05-29T18:09:01", "modified": "2017-07-29T01:32:00", "objectVersion": "1.3", "published": "2007-08-18T21:17:00", "references": ["http://secunia.com/advisories/26471", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY99261", "http://securitytracker.com/id?1018581", "http://www.vupen.com/english/advisories/2007/2912", "https://exchange.xforce.ibmcloud.com/vulnerabilities/36069", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98210", "http://www.attrition.org/pipermail/vim/2007-August/001765.html", "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=578", "http://www-1.ibm.com/support/docview.wss?uid=swg21255607", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "http://www.securityfocus.com/bid/25339"], "reporter": "cve@mitre.org", "title": "CVE-2007-4270", "type": "cve", "viewCount": 1}, "differentElements": ["cpe23", "cpe", "affectedSoftware"], "edition": 1, "lastseen": "2019-05-29T18:09:01"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "9.1"}, {"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "8.0"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:ibm:db2_universal_database:9.1", "cpe:/a:ibm:db2_universal_database:8.0"], "cpe23": ["cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*", "versionEndIncluding": "8.0", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "versionEndIncluding": "9.1", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2007-4270"], "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["NVD-CWE-Other"], "description": "Multiple race conditions in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain root privileges via a symlink attack on certain files.", "edition": 5, "enchantments": {"dependencies": {"modified": "2020-12-09T19:26:07", "references": [{"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_9FP3.NASL"], "type": "nessus"}, {"idList": ["SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837"], "type": "securityvulns"}], "rev": 2}, "score": {"modified": "2020-12-09T19:26:07", "rev": 2, "value": 6.6, "vector": "NONE"}}, "extraReferences": [], "hash": "68140a1e093a1aa0166a737fac743ddf33d6ef4eaa1f8ff257e7b906aa8bf572", "hashmap": [{"hash": "6b21b47957f43a1b3ca33a633a6637d7", "key": "cpe"}, {"hash": "abf842fdf7d486ef0ef4015250f1813d", "key": "cpeConfiguration"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b0671ec9efec47c462608bd6892c2395", "key": "href"}, {"hash": "5236b91902a09e689e0aae6ceeaf2acd", "key": "modified"}, {"hash": "8e1dda11a2a59822902431087165a840", "key": "description"}, {"hash": "d7ce86f4946e2f8ad0313fb8ca975a70", "key": "cvelist"}, {"hash": "2a4e43c4882b7c72b788a6b8f3c3e245", "key": "cvss2"}, {"hash": "78a7a5cbaf09985c14389298e454e7db", "key": "cwe"}, {"hash": "693b35bf6f5030e89ef1b487cb406a51", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "0e6d250ca0bdd50c0dfdef3f6e290de0", "key": "cpe23"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "extraReferences"}, {"hash": "a6ccbebe85ca6df634afd51e0875ab52", "key": "published"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "84aef925899d55ba908bf76bc2d7fbde", "key": "title"}, {"hash": "014b9175e8508627a39cbaf662515236", "key": "affectedSoftware"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d5f1840e27443eb2d6a17b941080264e", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4270", "id": "CVE-2007-4270", "lastseen": "2020-12-09T19:26:07", "modified": "2017-07-29T01:32:00", "objectVersion": "1.3", "published": "2007-08-18T21:17:00", "references": ["http://secunia.com/advisories/26471", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY99261", "http://securitytracker.com/id?1018581", "http://www.vupen.com/english/advisories/2007/2912", "https://exchange.xforce.ibmcloud.com/vulnerabilities/36069", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98210", "http://www.attrition.org/pipermail/vim/2007-August/001765.html", "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=578", "http://www-1.ibm.com/support/docview.wss?uid=swg21255607", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "http://www.securityfocus.com/bid/25339"], "reporter": "cve@mitre.org", "title": "CVE-2007-4270", "type": "cve", "viewCount": 2}, "differentElements": ["extraReferences"], "edition": 5, "lastseen": "2020-12-09T19:26:07"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "*"}, {"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "*"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:ibm:db2_universal_database:9.1", "cpe:/a:ibm:db2_universal_database:8.0"], "cpe23": ["cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*", "versionEndIncluding": "8.0", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "versionEndIncluding": "9.1", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2007-4270"], "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["NVD-CWE-Other"], "description": "Multiple race conditions in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain root privileges via a symlink attack on certain files.", "edition": 4, "enchantments": {"dependencies": {"modified": "2020-11-29T22:54:13", "references": [{"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_9FP3.NASL"], "type": "nessus"}, {"idList": ["SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837"], "type": "securityvulns"}], "rev": 2}, "score": {"modified": "2020-11-29T22:54:13", "rev": 2, "value": 6.6, "vector": "NONE"}}, "hash": "42f44ffef2c78c3726973818817807a5596696c509cdfb778a53c0bdfe8d8128", "hashmap": [{"hash": "67925e750ee714a2b14bb6d8e25db1fd", "key": "affectedSoftware"}, {"hash": "6b21b47957f43a1b3ca33a633a6637d7", "key": "cpe"}, {"hash": "abf842fdf7d486ef0ef4015250f1813d", "key": "cpeConfiguration"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b0671ec9efec47c462608bd6892c2395", "key": "href"}, {"hash": "5236b91902a09e689e0aae6ceeaf2acd", "key": "modified"}, {"hash": "8e1dda11a2a59822902431087165a840", "key": "description"}, {"hash": "d7ce86f4946e2f8ad0313fb8ca975a70", "key": "cvelist"}, {"hash": "2a4e43c4882b7c72b788a6b8f3c3e245", "key": "cvss2"}, {"hash": "78a7a5cbaf09985c14389298e454e7db", "key": "cwe"}, {"hash": "693b35bf6f5030e89ef1b487cb406a51", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "0e6d250ca0bdd50c0dfdef3f6e290de0", "key": "cpe23"}, {"hash": "a6ccbebe85ca6df634afd51e0875ab52", "key": "published"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "84aef925899d55ba908bf76bc2d7fbde", "key": "title"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d5f1840e27443eb2d6a17b941080264e", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4270", "id": "CVE-2007-4270", "lastseen": "2020-11-29T22:54:13", "modified": "2017-07-29T01:32:00", "objectVersion": "1.3", "published": "2007-08-18T21:17:00", "references": ["http://secunia.com/advisories/26471", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY99261", "http://securitytracker.com/id?1018581", "http://www.vupen.com/english/advisories/2007/2912", "https://exchange.xforce.ibmcloud.com/vulnerabilities/36069", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98210", "http://www.attrition.org/pipermail/vim/2007-August/001765.html", "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=578", "http://www-1.ibm.com/support/docview.wss?uid=swg21255607", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "http://www.securityfocus.com/bid/25339"], "reporter": "cve@mitre.org", "title": "CVE-2007-4270", "type": "cve", "viewCount": 2}, "differentElements": ["affectedSoftware"], "edition": 4, "lastseen": "2020-11-29T22:54:13"}, {"bulletin": {"affectedConfiguration": [], "affectedSoftware": [{"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "9.1"}, {"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "8.0"}], "bulletinFamily": "NVD", "cpe": ["cpe:/a:ibm:db2_universal_database:9.1", "cpe:/a:ibm:db2_universal_database:8.0"], "cpe23": ["cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*"], "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*", "versionEndIncluding": "8.0", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "versionEndIncluding": "9.1", "vulnerable": true}], "operator": "OR"}]}, "cvelist": ["CVE-2007-4270"], "cvss": {"score": 6.9, "vector": "AV:L/AC:M/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cwe": ["NVD-CWE-Other"], "description": "Multiple race conditions in IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 allow local users to gain root privileges via a symlink attack on certain files.", "edition": 3, "enchantments": {"dependencies": {"modified": "2020-10-03T11:45:53", "references": [{"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_9FP3.NASL"], "type": "nessus"}, {"idList": ["SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837"], "type": "securityvulns"}], "rev": 2}, "exploitation": {"modified": "2020-10-03T11:45:53", "wildExploited": false, "wildExploitedSources": []}, "score": {"modified": "2020-10-03T11:45:53", "rev": 2, "value": 6.6, "vector": "NONE"}}, "hash": "7dc212fa975bce456f1493550b042dde594979012e8b1d35b6cdd275609cc827", "hashmap": [{"hash": "6b21b47957f43a1b3ca33a633a6637d7", "key": "cpe"}, {"hash": "abf842fdf7d486ef0ef4015250f1813d", "key": "cpeConfiguration"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "affectedConfiguration"}, {"hash": "b0671ec9efec47c462608bd6892c2395", "key": "href"}, {"hash": "5236b91902a09e689e0aae6ceeaf2acd", "key": "modified"}, {"hash": "8e1dda11a2a59822902431087165a840", "key": "description"}, {"hash": "d7ce86f4946e2f8ad0313fb8ca975a70", "key": "cvelist"}, {"hash": "2a4e43c4882b7c72b788a6b8f3c3e245", "key": "cvss2"}, {"hash": "78a7a5cbaf09985c14389298e454e7db", "key": "cwe"}, {"hash": "693b35bf6f5030e89ef1b487cb406a51", "key": "references"}, {"hash": "1716b5fcbb7121af74efdc153d0166c5", "key": "type"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "cvss3"}, {"hash": "0e6d250ca0bdd50c0dfdef3f6e290de0", "key": "cpe23"}, {"hash": "a6ccbebe85ca6df634afd51e0875ab52", "key": "published"}, {"hash": "601892ece72be3be2f57266ca2354792", "key": "bulletinFamily"}, {"hash": "84aef925899d55ba908bf76bc2d7fbde", "key": "title"}, {"hash": "014b9175e8508627a39cbaf662515236", "key": "affectedSoftware"}, {"hash": "444c2b4dda4a55437faa8bef1a141e84", "key": "reporter"}, {"hash": "d5f1840e27443eb2d6a17b941080264e", "key": "cvss"}], "history": [], "href": "https://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2007-4270", "id": "CVE-2007-4270", "lastseen": "2020-10-03T11:45:53", "modified": "2017-07-29T01:32:00", "objectVersion": "1.3", "published": "2007-08-18T21:17:00", "references": ["http://secunia.com/advisories/26471", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY99261", "http://securitytracker.com/id?1018581", "http://www.vupen.com/english/advisories/2007/2912", "https://exchange.xforce.ibmcloud.com/vulnerabilities/36069", "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98210", "http://www.attrition.org/pipermail/vim/2007-August/001765.html", "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=578", "http://www-1.ibm.com/support/docview.wss?uid=swg21255607", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "http://www.securityfocus.com/bid/25339"], "reporter": "cve@mitre.org", "title": "CVE-2007-4270", "type": "cve", "viewCount": 2}, "differentElements": ["affectedSoftware"], "edition": 3, "lastseen": "2020-10-03T11:45:53"}], "edition": 7, "hashmap": [{"key": "affectedConfiguration", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "affectedSoftware", "hash": "014b9175e8508627a39cbaf662515236"}, {"key": "bulletinFamily", "hash": "601892ece72be3be2f57266ca2354792"}, {"key": "cpe", "hash": "6b21b47957f43a1b3ca33a633a6637d7"}, {"key": "cpe23", "hash": "0e6d250ca0bdd50c0dfdef3f6e290de0"}, {"key": "cpeConfiguration", "hash": "68686f57732d725758f3fbacd5311ca5"}, {"key": "cvelist", "hash": "d7ce86f4946e2f8ad0313fb8ca975a70"}, {"key": "cvss", "hash": "d5f1840e27443eb2d6a17b941080264e"}, {"key": "cvss2", "hash": "2a4e43c4882b7c72b788a6b8f3c3e245"}, {"key": "cvss3", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "cwe", "hash": "78a7a5cbaf09985c14389298e454e7db"}, {"key": "description", "hash": "8e1dda11a2a59822902431087165a840"}, {"key": "extraReferences", "hash": "dc6f826fa9e7967b19bf39dd7cac1a30"}, {"key": "href", "hash": "b0671ec9efec47c462608bd6892c2395"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "5236b91902a09e689e0aae6ceeaf2acd"}, {"key": "published", "hash": "a6ccbebe85ca6df634afd51e0875ab52"}, {"key": "references", "hash": "693b35bf6f5030e89ef1b487cb406a51"}, {"key": "reporter", "hash": "444c2b4dda4a55437faa8bef1a141e84"}, {"key": "title", "hash": "84aef925899d55ba908bf76bc2d7fbde"}, {"key": "type", "hash": "1716b5fcbb7121af74efdc153d0166c5"}], "hash": "c86441dad300ec3275241db628af062bc94c99f51756d0f1d24591d396d272db", "viewCount": 9, "enchantments": {"dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837"]}, {"type": "seebug", "idList": ["SSV:2138"]}, {"type": "nessus", "idList": ["DB2_9FP3.NASL"]}], "modified": "2021-04-21T20:36:29", "rev": 2}, "score": {"value": 6.6, "vector": "NONE", "modified": "2021-04-21T20:36:29", "rev": 2}}, "objectVersion": "1.5", "cpe": ["cpe:/a:ibm:db2_universal_database:9.1", "cpe:/a:ibm:db2_universal_database:8.0"], "affectedSoftware": [{"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "9.1"}, {"cpeName": "ibm:db2_universal_database", "name": "ibm db2 universal database", "operator": "le", "version": "8.0"}], "cvss2": {"cvssV2": {"accessComplexity": "MEDIUM", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 6.9, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 3.4, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": false}, "cvss3": {}, "cpe23": ["cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*"], "cwe": ["NVD-CWE-Other"], "scheme": null, "cpeConfiguration": {"CVE_data_version": "4.0", "nodes": [{"children": [], "cpe_match": [{"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:9.1:*:fp2:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "9.1", "vulnerable": true}, {"cpe23Uri": "cpe:2.3:a:ibm:db2_universal_database:8.0:fp14:*:*:*:*:*:*", "cpe_name": [], "versionEndIncluding": "8.0", "vulnerable": true}], "operator": "OR"}]}, "extraReferences": [{"name": "db2-binaries-symlink(36069)", "refsource": "XF", "tags": [], "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/36069"}, {"name": "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "refsource": "CONFIRM", "tags": ["Patch"], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21255352"}, {"name": "20070816 IBM DB2 Universal Database Multiple Race Condition Vulnerabilities", "refsource": "IDEFENSE", "tags": [], "url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=578"}, {"name": "[VIM] 20070821 Recent DB2 Vulnerabilities", "refsource": "MLIST", "tags": [], "url": "http://www.attrition.org/pipermail/vim/2007-August/001765.html"}, {"name": "25339", "refsource": "BID", "tags": [], "url": "http://www.securityfocus.com/bid/25339"}, {"name": "IY99261", "refsource": "AIXAPAR", "tags": [], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IY99261"}, {"name": "http://www-1.ibm.com/support/docview.wss?uid=swg21255607", "refsource": "CONFIRM", "tags": ["Patch"], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg21255607"}, {"name": "1018581", "refsource": "SECTRACK", "tags": [], "url": "http://securitytracker.com/id?1018581"}, {"name": "26471", "refsource": "SECUNIA", "tags": ["Patch", "Vendor Advisory"], "url": "http://secunia.com/advisories/26471"}, {"name": "IY98210", "refsource": "AIXAPAR", "tags": [], "url": "http://www-1.ibm.com/support/docview.wss?uid=swg1IY98210"}, {"name": "ADV-2007-2912", "refsource": "VUPEN", "tags": [], "url": "http://www.vupen.com/english/advisories/2007/2912"}], "immutableFields": []}], "seebug": [{"href": "https://www.seebug.org/vuldb/ssvid-2138", "status": "details", "history": [], "bulletinFamily": "exploit", "modified": "2007-08-19T00:00:00", "title": "IBM DB2 Universal Database\u591a\u4e2a\u672c\u5730\u5b89\u5168\u6f0f\u6d1e", "cvss": {"vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/", "score": 6.9}, "sourceHref": "", "cvelist": ["CVE-2007-4270", "CVE-2007-4271", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4275", "CVE-2007-4276"], "description": "BUGTRAQ ID: 25339\r\nCVE(CAN) ID: CVE-2007-4270,CVE-2007-4271,CVE-2007-4272,CVE-2007-4273,CVE-2007-4275,CVE-2007-4276\r\n\r\nIBM DB2\u662f\u4e00\u4e2a\u5927\u578b\u7684\u5546\u4e1a\u5173\u7cfb\u6570\u636e\u5e93\u7cfb\u7edf\uff0c\u9762\u5411\u7535\u5b50\u5546\u52a1\u3001\u5546\u4e1a\u8d44\u8baf\u3001\u5185\u5bb9\u7ba1\u7406\u3001\u5ba2\u6237\u5173\u7cfb\u7ba1\u7406\u7b49\u5e94\u7528\uff0c\u53ef\u8fd0\u884c\u4e8eAIX\u3001HP-UX\u3001Linux\u3001Solaris\u3001Windows\u7b49\u7cfb\u7edf\u3002\r\n\r\nIBM DB2\u7684\u591a\u4e2a\u5de5\u5177\u5b9e\u73b0\u4e0a\u5b58\u5728\u6f0f\u6d1e\uff0c\u672c\u5730\u653b\u51fb\u8005\u53ef\u80fd\u5229\u7528\u8fd9\u4e9b\u6f0f\u6d1e\u63d0\u5347\u81ea\u5df1\u7684\u6743\u9650\u3002\r\n\r\nIBM DB2\u5728\u5904\u7406\u62e5\u6709\u63d0\u5347\u6743\u9650\u7684\u6587\u4ef6\u65f6\u6ca1\u6709\u6267\u884c\u5145\u5206\u7684\u68c0\u67e5\uff0c\u5bfc\u81f4\u5728\u5224\u65ad\u73b0\u6709\u6587\u4ef6\u662f\u5426\u4e3a\u7b26\u53f7\u94fe\u63a5\u548c\u4fee\u6539\u6587\u4ef6\u4e4b\u95f4\u5b58\u5728\u7ade\u4e89\u6761\u4ef6\u3002\u5982\u679c\u653b\u51fb\u8005\u80fd\u591f\u8fc5\u901f\u5e76\u53cd\u590d\u7684\u91cd\u65b0\u521b\u5efa\u7b26\u53f7\u94fe\u63a5\u6587\u4ef6\uff0c\u5c31\u53ef\u80fd\u4ee5root\u7528\u6237\u6743\u9650\u4fee\u6539\u4efb\u610f\u6587\u4ef6\u3002\r\n\r\n\u4e00\u4e9b\u4ee5setuid-root\u5b89\u88c5\u7684DB2\u4e8c\u8fdb\u5236\u7a0b\u5e8f\u4f1a\u5c06\u4e8b\u4ef6\u4fe1\u606f\u4fdd\u5b58\u5230\u65e5\u5fd7\u6587\u4ef6\u3002\u5728\u521b\u5efa\u5230\u76ee\u6807\u6587\u4ef6\u7684\u5b8c\u6574\u8def\u5f84\u65f6\uff0c\u4f1a\u5c06/tmp/\u8fde\u63a5\u5230\u73af\u5883\u53d8\u91cf\u4e0a\u3002\u7531\u4e8e\u6ca1\u6709\u5bf9\u73af\u5883\u53d8\u91cf\u4e2d\u7684\u8def\u5f84\u904d\u5386\u5b57\u7b26\u4e32\uff08\u5982../\uff09\u6267\u884c\u68c0\u67e5\uff0c\u56e0\u6b64\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u76ee\u5f55\u904d\u5386\u653b\u51fb\u5728\u7cfb\u7edf\u4e0a\u521b\u5efa\u4efb\u610f\u6587\u4ef6\u3002 \r\n\r\nIBM DB2\u5728\u5904\u7406\u62e5\u6709\u63d0\u5347\u6743\u9650\u7684\u6587\u4ef6\u65f6\u6ca1\u6709\u6267\u884c\u5145\u5206\u7684\u68c0\u67e5\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u7ed3\u5408\u73af\u5883\u53d8\u91cf\u5728\u7cfb\u7edf\u4e0a\u521b\u5efa\u6216\u9644\u52a0\u4efb\u610f\u6587\u4ef6\u3002\r\n\r\nDB2\u4e2d\u6240\u6346\u7ed1\u7684\u4e00\u4e9bsetuid\u4e8c\u8fdb\u5236\u7a0b\u5e8f\u6ca1\u6709\u5b89\u5168\u7684\u521b\u5efa\u76ee\u5f55\uff0c\u5728\u521b\u5efa\u7279\u5b9a\u7684\u76ee\u5f55\u7ed3\u6784\u65f6\u4f1a\u8ddf\u968f\u653b\u51fb\u8005\u7279\u5236\u7684\u7b26\u53f7\u94fe\u63a5\uff0c\u5bfc\u81f4\u5728\u6587\u4ef6\u7cfb\u7edf\u4e2d\u7684\u4efb\u610f\u4f4d\u7f6e\u521b\u5efa\u5b8c\u5168\u53ef\u5199\u7684\u76ee\u5f55\u3002\r\n\r\nDB2\u53ef\u80fd\u5141\u8bb8\u5728\u4e0d\u53ef\u4fe1\u4efb\u7684\u8def\u5f84\u4e2d\u6267\u884c\u4e8c\u8fdb\u5236\u7a0b\u5e8f\u6216\u52a0\u8f7d\u51fd\u6570\u5e93\uff0c\u751f\u6210\u4e8c\u8fdb\u5236\u7a0b\u5e8f\u6216\u51fd\u6570\u5e93\u7684\u8def\u5f84\u662f\u57fa\u4e8e\u653b\u51fb\u8005\u63a7\u5236\u7684\u73af\u5883\u53d8\u91cf\u7684\uff1b\u6b64\u5916\u6240\u8981\u6267\u884c\u6216\u52a0\u8f7d\u7684\u6587\u4ef6\u4e5f\u662f\u4f4d\u4e8e\u653b\u51fb\u8005\u63a7\u5236\u7684\u76ee\u5f55\u4e2d\u3002\r\n\r\nDB2\u6ca1\u6709\u5bf9\u7528\u6237\u63d0\u4f9b\u6570\u636e\u7684\u957f\u5ea6\u6267\u884c\u5145\u5206\u7684\u9a8c\u8bc1\uff0c\u5982\u679c\u653b\u51fb\u8005\u901a\u8fc7\u67d0\u4e9b\u73af\u5883\u53d8\u91cf\u6307\u5b9a\u4e86\u7279\u5236\u7684\u5b57\u7b26\u4e32\u7684\u8bdd\uff0c\u5c31\u53ef\u80fd\u5c06\u5b57\u7b26\u4e32\u62f7\u8d1d\u5230\u6808\u4e0a\u6240\u5b58\u50a8\u7684\u9759\u6001\u5927\u5c0f\u7f13\u51b2\u533a\uff0c\u89e6\u53d1\u6808\u6ea2\u51fa\u5e76\u6267\u884c\u4efb\u610f\u6307\u4ee4\u3002\r\n\n\nIBM DB2 Universal Database 9.1\r\nIBM DB2 Universal Database 8.0\n \u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u8fd9\u4e2a\u5b89\u5168\u95ee\u9898\uff0c\u8bf7\u5230\u5382\u5546\u7684\u4e3b\u9875\u4e0b\u8f7d\uff1a\r\n\r\n<a href=\"http://www-1.ibm.com/support/docview.wss?uid=swg1IY88226\" target=\"_blank\">http://www-1.ibm.com/support/docview.wss?uid=swg1IY88226</a>\r\n<a href=\"http://www-1.ibm.com/support/docview.wss?uid=swg1JR25940\" target=\"_blank\">http://www-1.ibm.com/support/docview.wss?uid=swg1JR25940</a>\r\n<a href=\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\" target=\"_blank\">http://www-1.ibm.com/support/docview.wss?uid=swg21255352</a>\r\n<a href=\"http://www-1.ibm.com/support/docview.wss?uid=swg21255607\" target=\"_blank\">http://www-1.ibm.com/support/docview.wss?uid=swg21255607</a>", "viewCount": 3, "published": "2007-08-19T00:00:00", "sourceData": "", "id": "SSV:2138", "enchantments_done": [], "_object_type": "robots.models.seebug.SeebugBulletin", "type": "seebug", "lastseen": "2017-11-19T21:59:35", "reporter": "Root", "_object_types": ["robots.models.base.Bulletin", "robots.models.seebug.SeebugBulletin"], "enchantments": {"score": {"value": 7.0, "vector": "NONE", "modified": "2017-11-19T21:59:35", "rev": 2}, "dependencies": {"references": [{"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17836", "SECURITYVULNS:DOC:17835", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17838"]}, {"type": "cve", "idList": ["CVE-2007-4272", "CVE-2007-4270", "CVE-2007-4273", "CVE-2007-4271", "CVE-2007-4275", "CVE-2007-4276"]}, {"type": "nessus", "idList": ["DB2_9FP3.NASL"]}], "modified": "2017-11-19T21:59:35", "rev": 2}}, "objectVersion": "1.4", "references": []}], "securityvulns": [{"id": "SECURITYVULNS:VULN:8068", "bulletinFamily": "software", "title": "IBM DB2 database multiple security vulnerabilities", "description": "Directory traversal, buffer overflow, shared libraries loaded from insecure locations, files and directories manipulation.", "published": "2007-08-18T00:00:00", "modified": "2007-08-18T00:00:00", "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:8068", "reporter": "BUGTRAQ", "references": ["https://vulners.com/securityvulns/securityvulns:doc:17835", "https://vulners.com/securityvulns/securityvulns:doc:17834", "https://vulners.com/securityvulns/securityvulns:doc:17836", "https://vulners.com/securityvulns/securityvulns:doc:17833", "https://vulners.com/securityvulns/securityvulns:doc:17838", "https://vulners.com/securityvulns/securityvulns:doc:17837"], "cvelist": ["CVE-2007-4275", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "type": "securityvulns", "lastseen": "2021-06-08T18:52:45", "history": [{"bulletin": {"affectedSoftware": [{"name": "DB2", "operator": "eq", "version": "9.1"}], "bulletinFamily": "software", "cvelist": ["CVE-2007-4275", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "cvss": {"score": 6.9, "vector": "AV:LOCAL/AC:MEDIUM/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "description": "Directory traversal, buffer overflow, shared libraries loaded from insecure locations, files and directories manipulation.", "edition": 1, "enchantments": {"dependencies": {"modified": "2018-08-31T11:09:26", "references": [{"idList": ["SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17838", "SECURITYVULNS:DOC:17836", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17835"], "type": "securityvulns"}, {"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_9FP3.NASL"], "type": "nessus"}, {"idList": ["CVE-2007-4275", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "type": "cve"}], "rev": 2}, "score": {"modified": "2018-08-31T11:09:26", "rev": 2, "value": 6.4, "vector": "NONE"}}, "hash": "e9036daac4181ab5afe128d4598165231c2f884452527c6547ab5cfe6abe7922", "hashmap": [{"hash": "2085665427ddc772ca567af71eb7739c", "key": "affectedSoftware"}, {"hash": "d41d8cd98f00b204e9800998ecf8427e", "key": "immutableFields"}, {"hash": "a37eeadcb3e87b470632efe917ab45be", "key": "cvelist"}, {"hash": "76714af176d1cee0fe66e50158165159", "key": "title"}, {"hash": "f9fa10ba956cacf91d7878861139efb9", "key": "bulletinFamily"}, {"hash": "bfff0b5386bf3d88614a4791fe44aa97", "key": "references"}, {"hash": "e8bafdc9ad5c6f47fe1e6e5fd509b7a9", "key": "cvss"}, {"hash": "679369d01452db066524b3888577f295", "key": "published"}, {"hash": "8bd6446a834564190185cecc2f611062", "key": "href"}, {"hash": "2c5cca82a8670da097919f6160833daf", "key": "reporter"}, {"hash": "a70dac67f04d85d83207f408c11d62eb", "key": "description"}, {"hash": "679369d01452db066524b3888577f295", "key": "modified"}, {"hash": "d54751dd75af2ea0147b462b3e001cd0", "key": "type"}], "history": [], "href": "https://vulners.com/securityvulns/SECURITYVULNS:VULN:8068", "id": "SECURITYVULNS:VULN:8068", "immutableFields": [], "lastseen": "2018-08-31T11:09:26", "modified": "2007-08-18T00:00:00", "objectVersion": "1.5", "published": "2007-08-18T00:00:00", "references": ["https://vulners.com/securityvulns/securityvulns:doc:17835", "https://vulners.com/securityvulns/securityvulns:doc:17834", "https://vulners.com/securityvulns/securityvulns:doc:17836", "https://vulners.com/securityvulns/securityvulns:doc:17833", "https://vulners.com/securityvulns/securityvulns:doc:17838", "https://vulners.com/securityvulns/securityvulns:doc:17837"], "reporter": "BUGTRAQ", "title": "IBM DB2 database multiple security vulnerabilities", "type": "securityvulns", "viewCount": 6}, "different_elements": ["affectedSoftware"], "edition": 1, "lastseen": "2018-08-31T11:09:26"}], "edition": 2, "hashmap": [{"key": "affectedSoftware", "hash": "5fda9bad6a500b3cd20996428b95f89d"}, {"key": "bulletinFamily", "hash": "f9fa10ba956cacf91d7878861139efb9"}, {"key": "cvelist", "hash": "a37eeadcb3e87b470632efe917ab45be"}, {"key": "cvss", "hash": "e8bafdc9ad5c6f47fe1e6e5fd509b7a9"}, {"key": "description", "hash": "a70dac67f04d85d83207f408c11d62eb"}, {"key": "href", "hash": "8bd6446a834564190185cecc2f611062"}, {"key": "immutableFields", "hash": "d41d8cd98f00b204e9800998ecf8427e"}, {"key": "modified", "hash": "679369d01452db066524b3888577f295"}, {"key": "published", "hash": "679369d01452db066524b3888577f295"}, {"key": "references", "hash": "bfff0b5386bf3d88614a4791fe44aa97"}, {"key": "reporter", "hash": "2c5cca82a8670da097919f6160833daf"}, {"key": "title", "hash": "76714af176d1cee0fe66e50158165159"}, {"key": "type", "hash": "d54751dd75af2ea0147b462b3e001cd0"}], "hash": "f777f9f30ed98b26da1e02aac30189db5f96b89573770be7fc7f12b8dede8a15", "viewCount": 6, "enchantments": {"dependencies": {"references": [{"type": "seebug", "idList": ["SSV:2138"]}, {"type": "cve", "idList": ["CVE-2007-4271", "CVE-2007-4273", "CVE-2007-4276", "CVE-2007-4272", "CVE-2007-4270", "CVE-2007-4275"]}, {"type": "nessus", "idList": ["DB2_9FP3.NASL"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:17838", "SECURITYVULNS:DOC:17836", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:DOC:17835", "SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17837"]}], "modified": "2021-06-08T18:52:45", "rev": 2}, "score": {"value": 6.4, "vector": "NONE", "modified": "2021-06-08T18:52:45", "rev": 2}}, "objectVersion": "1.5", "affectedSoftware": [{"name": "db2", "operator": "eq", "version": "9.1"}], "immutableFields": [], "scheme": null}], "nessus": [{"id": "DB2_9FP3.NASL", "hash": "7340ae3e1aa5a92dc18c0aeaf8adc3b2", "type": "nessus", "bulletinFamily": "scanner", "title": "IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities", "description": "According to its version, the installation of IBM DB2 running on the remote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files, create arbitrary world-writeable directories, or gain root privileges via symlink attacks or specially crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege elevation when DB2 'execs' executables while running as root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to incorrect authorization routines. (JR25940, version 8 only)\n\n - There is an unspecified vulnerability in 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 only)\n\n - There is an unspecified vulnerability in the 'db2licm' and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE' environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF' environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code execution without the need for authentication due to a stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service issues that can be triggered by packets with an invalid LANG parameter or a long packet, which cause the process to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to what extent the first set of issues overlaps the others.", "published": "2007-08-20T00:00:00", "modified": "2018-11-15T00:00:00", "cvss": {"score": 10, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/25905", "reporter": "This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://seclists.org/fulldisclosure/2007/Aug/318", "https://seclists.org/fulldisclosure/2007/Aug/314", "https://seclists.org/fulldisclosure/2007/Aug/315", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2582", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4270", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4272", "https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/", "https://seclists.org/fulldisclosure/2007/Aug/317", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4273", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4271", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4276", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4417", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4423", "https://seclists.org/bugtraq/2007/Oct/153", "https://seclists.org/fulldisclosure/2007/Aug/319", "https://seclists.org/fulldisclosure/2007/Aug/313", "https://www-01.ibm.com/support/docview.wss?uid=swg21255607", "https://seclists.org/fulldisclosure/2007/Aug/316", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4418", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4275"], "cvelist": ["CVE-2007-2582", "CVE-2007-4270", "CVE-2007-4271", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4275", "CVE-2007-4276", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4423"], "immutableFields": [], "lastseen": "2021-10-16T03:02:54", "history": [{"bulletin": {"id": "DB2_9FP3.NASL", "hash": "2ae653c395b588d3a6af2e5dd800877c7c7eb998d9760f8f4e4a4523d0351a04", "type": "nessus", "bulletinFamily": "exploit", "title": "IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities", "description": "According to its version, the installation of IBM DB2 running on the remote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files, create arbitrary world-writeable directories, or gain root privileges via symlink attacks or specially crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege elevation when DB2 'execs' executables while running as root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to incorrect authorization routines. (JR25940, version 8 only)\n\n - There is an unspecified vulnerability in 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 only)\n\n - There is an unspecified vulnerability in the 'db2licm' and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE' environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF' environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code execution without the need for authentication due to a stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service issues that can be triggered by packets with an invalid LANG parameter or a long packet, which cause the process to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to what extent the first set of issues overlaps the others.", "published": "2007-08-20T00:00:00", "modified": "2016-05-19T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "cvss2": {}, "cvss3": {}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=25905", "reporter": "Tenable", "references": ["http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0318.html", "http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0316.html", "http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0314.html", "http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0315.html", "http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0319.html", "http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0317.html", "http://archives.neohapsis.com/archives/bugtraq/2007-10/0153.html", "http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0313.html", "http://www.appsecinc.com/resources/alerts/db2/2007-01.shtml", "http://www-1.ibm.com/support/docview.wss?uid=swg21255607", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352"], "cvelist": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "immutableFields": [], "lastseen": "2016-09-26T17:23:10", "history": [], "viewCount": 0, "enchantments": {}, "objectVersion": "1.6", "pluginID": "25905", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25905);\n script_version(\"$Revision: 1.28 $\");\n script_cvs_date(\"$Date: 2016/05/19 17:45:43 $\");\n\n script_cve_id(\"CVE-2007-2582\", \"CVE-2007-4270\", \"CVE-2007-4271\", \"CVE-2007-4272\",\n \"CVE-2007-4273\", \"CVE-2007-4275\", \"CVE-2007-4276\", \"CVE-2007-4417\", \"CVE-2007-4418\", \"CVE-2007-4423\");\n script_bugtraq_id(23890, 25339, 26010);\n script_osvdb_id(\n 40973,\n 40975,\n 40976,\n 40977,\n 40978,\n 40979,\n 40980,\n 40981,\n 40982,\n 40983,\n 40984,\n 40989,\n 40990,\n 40991,\n 40992,\n 40993,\n 40994\n );\n\n script_name(english:\"IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities\");\n script_summary(english:\"Checks DB2 signature.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.\" );\n script_set_attribute(attribute:\"see_also\", value:\"http://www.appsecinc.com/resources/alerts/db2/2007-01.shtml\");\n script_set_attribute(attribute:\"see_also\", value:\"http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0313.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0314.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0315.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0316.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0317.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0318.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://archives.neohapsis.com/archives/fulldisclosure/2007-08/0319.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://archives.neohapsis.com/archives/bugtraq/2007-10/0153.html\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255607\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8\nor later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:POC/RL:OF/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(119);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/08/20\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:ibm:db2\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n \n script_copyright(english:\"This script is Copyright (C) 2007-2016 Tenable Network Security, Inc.\");\n \n script_dependencies(\"db2_das_detect.nasl\");\n script_require_ports(\"Services/db2das\", 523);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\n\nport = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);\n\nlevel = get_kb_item_or_exit(\"DB2/\"+port+\"/Level\");\nif (\n level !~ '^9\\\\.[01]\\\\.' &&\n level !~ '^([0-7]\\\\.|8\\\\.[01])'\n) exit(0, \"The version of IBM DB2 listening on port \"+port+\" is not 9.0, 9.1, or less than or equal to 8.1.x and thus is not affected.\");\n\nplatform = get_kb_item_or_exit(\"DB2/\"+port+\"/Platform\");\nplatform_name = get_kb_item(\"DB2/\"+port+\"/Platform_Name\");\nif (isnull(platform_name))\n{\n platform_name = platform;\n report_phrase = \"platform \" + platform;\n}\nelse\n report_phrase = platform_name;\nreport = \"\";\n\n# Windows x86\nif (platform == 5)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.300.257';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n report = \n '\\n Platform : ' + platform_name +\n '\\n Installed level : ' + level +\n '\\n Fixed level : ' + fixed_level + '\\n';\n }\n else\n {\n fixed_level = '8.1.15.254';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n report =\n '\\n Platform : ' + platform_name +\n '\\n Installed level : ' + level +\n '\\n Fixed level : ' + fixed_level + '\\n';\n }\n}\nelse if (platform == 18)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.0.3';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n report =\n '\\n Platform : ' + platform_name +\n '\\n Installed level : ' + level +\n '\\n Fixed level : ' + fixed_level + '\\n';\n }\n else\n {\n if (level =~ '^8\\\\.1\\\\.0\\\\.') fixed_level = '8.1.0.136';\n else fixed_level = '8.1.2.136';\n\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n report =\n '\\n Platform : ' + platform_name +\n '\\n Installed level : ' + level +\n '\\n Fixed level : ' + fixed_level + '\\n';\n }\n}\nelse\n{\n info =\n 'Nessus does not support version checks against ' + report_phrase + '.\\n' +\n 'To help us better identify vulnerable versions, please send the platform\\n' +\n 'number along with details about the platform, including the operating system\\n' +\n 'version, CPU architecture, and DB2 version to db2-platform-info@nessus.org.\\n';\n exit(1, info);\n}\n\nif (report)\n{\n if (report_verbosity > 0) security_hole(port:port, extra:report);\n else security_hole(port);\n}\nelse exit(0, \"IBM DB2 \"+level+\" on \" + report_phrase + \" is listening on port \"+port+\" and is not affected.\");\n", "naslFamily": "Databases", "cpe": [], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2016-09-26T17:23:10", "differentElements": ["bulletinFamily", "cpe", "description", "modified", "references", "sourceData"], "edition": 1}, {"bulletin": {"id": "DB2_9FP3.NASL", "hash": "16218c848376eeab2fbd0b7f45b92e638c61763313c21e4f77239a9fbdf3e711", "type": "nessus", "bulletinFamily": "scanner", "title": "IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities", "description": "According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.", "published": "2007-08-20T00:00:00", "modified": "2018-11-15T00:00:00", "cvss": {"score": 10.0, "vector": "AV:NETWORK/AC:LOW/Au:NONE/C:COMPLETE/I:COMPLETE/A:COMPLETE/"}, "cvss2": {}, "cvss3": {}, "href": "https://www.tenable.com/plugins/index.php?view=single&id=25905", "reporter": "Tenable", "references": ["https://seclists.org/fulldisclosure/2007/Aug/317", "https://seclists.org/fulldisclosure/2007/Aug/318", "https://seclists.org/bugtraq/2007/Oct/153", "https://seclists.org/fulldisclosure/2007/Aug/313", "https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/", "https://www-01.ibm.com/support/docview.wss?uid=swg21255607", "https://seclists.org/fulldisclosure/2007/Aug/316", "https://seclists.org/fulldisclosure/2007/Aug/315", "https://seclists.org/fulldisclosure/2007/Aug/314", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "https://seclists.org/fulldisclosure/2007/Aug/319"], "cvelist": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "immutableFields": [], "lastseen": "2019-01-16T20:07:26", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"modified": "2019-01-16T20:07:26", "references": [{"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_JDBC"], "type": "canvas"}, {"idList": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "type": "cve"}, {"idList": ["SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17838", "SECURITYVULNS:DOC:17836", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17835"], "type": "securityvulns"}, {"idList": ["ZDI-07-056"], "type": "zdi"}]}, "score": {"value": 7.2, "vector": "NONE"}}, "objectVersion": "1.6", "pluginID": "25905", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25905);\n script_version(\"1.34\");\n script_cvs_date(\"Date: 2018/11/15 20:50:21\");\n\n script_cve_id(\"CVE-2007-2582\", \"CVE-2007-4270\", \"CVE-2007-4271\", \"CVE-2007-4272\",\n \"CVE-2007-4273\", \"CVE-2007-4275\", \"CVE-2007-4276\", \"CVE-2007-4417\", \"CVE-2007-4418\", \"CVE-2007-4423\");\n script_bugtraq_id(23890, 25339, 26010);\n\n script_name(english:\"IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities\");\n script_summary(english:\"Checks DB2 signature.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/316\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/319\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/bugtraq/2007/Oct/153\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www-01.ibm.com/support/docview.wss?uid=swg21255607\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8\nor later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(22, 119, 134);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/08/20\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:ibm:db2\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n \n script_copyright(english:\"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n \n script_dependencies(\"db2_das_detect.nasl\");\n script_require_ports(\"Services/db2das\", 523);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"db2_report_func.inc\");\n\nport = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);\n\nlevel = get_kb_item_or_exit(\"DB2/\"+port+\"/Level\");\nif (\n level !~ '^9\\\\.[01]\\\\.' &&\n level !~ '^([0-7]\\\\.|8\\\\.[01])'\n) exit(0, \"The version of IBM DB2 listening on port \"+port+\" is not 9.0, 9.1, or less than or equal to 8.1.x and thus is not affected.\");\n\nplatform = get_kb_item_or_exit(\"DB2/\"+port+\"/Platform\");\nplatform_name = get_kb_item(\"DB2/\"+port+\"/Platform_Name\");\nif (isnull(platform_name))\n{\n platform_name = platform;\n report_phrase = \"platform \" + platform;\n}\nelse\n report_phrase = platform_name;\n\nvuln = FALSE;\n# Windows x86\nif (platform == 5)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.300.257';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n fixed_level = '8.1.15.254';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse if (platform == 18)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.0.3';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n if (level =~ '^8\\\\.1\\\\.0\\\\.') fixed_level = '8.1.0.136';\n else fixed_level = '8.1.2.136';\n\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse\n{\n info =\n 'Nessus does not support version checks against ' + report_phrase + '.\\n' +\n 'To help us better identify vulnerable versions, please send the platform\\n' +\n 'number along with details about the platform, including the operating system\\n' +\n 'version, CPU architecture, and DB2 version to db2-platform-info@nessus.org.\\n';\n exit(1, info);\n}\n\nif (vuln)\n{\n report_db2(\n severity : SECURITY_HOLE,\n port : port,\n platform_name : platform_name,\n installed_level : level,\n fixed_level : fixed_level);\n}\nelse exit(0, \"IBM DB2 \"+level+\" on \" + report_phrase + \" is listening on port \"+port+\" and is not affected.\");\n", "naslFamily": "Databases", "cpe": ["cpe:/a:ibm:db2"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2019-01-16T20:07:26", "differentElements": ["cvss", "description", "href", "modified", "reporter"], "edition": 2}, {"bulletin": {"id": "DB2_9FP3.NASL", "hash": "aced21ab99a66ac321bd1afea8864ad220c7112a22f99019857eb383a4335dce", "type": "nessus", "bulletinFamily": "scanner", "title": "IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities", "description": "According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 ", "published": "2007-08-20T00:00:00", "modified": "2019-10-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {}, "href": "https://www.tenable.com/plugins/nessus/25905", "reporter": "This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://seclists.org/fulldisclosure/2007/Aug/317", "https://seclists.org/fulldisclosure/2007/Aug/318", "https://seclists.org/bugtraq/2007/Oct/153", "https://seclists.org/fulldisclosure/2007/Aug/313", "https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/", "https://www-01.ibm.com/support/docview.wss?uid=swg21255607", "https://seclists.org/fulldisclosure/2007/Aug/316", "https://seclists.org/fulldisclosure/2007/Aug/315", "https://seclists.org/fulldisclosure/2007/Aug/314", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "https://seclists.org/fulldisclosure/2007/Aug/319"], "cvelist": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "immutableFields": [], "lastseen": "2019-10-28T20:03:15", "history": [], "viewCount": 1, "enchantments": {"dependencies": {"modified": "2019-10-28T20:03:15", "references": [{"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_JDBC"], "type": "canvas"}, {"idList": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "type": "cve"}, {"idList": ["SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17838", "SECURITYVULNS:DOC:17836", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17835"], "type": "securityvulns"}, {"idList": ["ZDI-07-056"], "type": "zdi"}]}, "score": {"modified": "2019-10-28T20:03:15", "value": 8.4, "vector": "NONE"}}, "objectVersion": "1.6", "pluginID": "25905", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25905);\n script_version(\"1.34\");\n script_cvs_date(\"Date: 2018/11/15 20:50:21\");\n\n script_cve_id(\"CVE-2007-2582\", \"CVE-2007-4270\", \"CVE-2007-4271\", \"CVE-2007-4272\",\n \"CVE-2007-4273\", \"CVE-2007-4275\", \"CVE-2007-4276\", \"CVE-2007-4417\", \"CVE-2007-4418\", \"CVE-2007-4423\");\n script_bugtraq_id(23890, 25339, 26010);\n\n script_name(english:\"IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities\");\n script_summary(english:\"Checks DB2 signature.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/316\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/319\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/bugtraq/2007/Oct/153\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www-01.ibm.com/support/docview.wss?uid=swg21255607\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8\nor later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(22, 119, 134);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/08/20\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:ibm:db2\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n \n script_copyright(english:\"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n \n script_dependencies(\"db2_das_detect.nasl\");\n script_require_ports(\"Services/db2das\", 523);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"db2_report_func.inc\");\n\nport = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);\n\nlevel = get_kb_item_or_exit(\"DB2/\"+port+\"/Level\");\nif (\n level !~ '^9\\\\.[01]\\\\.' &&\n level !~ '^([0-7]\\\\.|8\\\\.[01])'\n) exit(0, \"The version of IBM DB2 listening on port \"+port+\" is not 9.0, 9.1, or less than or equal to 8.1.x and thus is not affected.\");\n\nplatform = get_kb_item_or_exit(\"DB2/\"+port+\"/Platform\");\nplatform_name = get_kb_item(\"DB2/\"+port+\"/Platform_Name\");\nif (isnull(platform_name))\n{\n platform_name = platform;\n report_phrase = \"platform \" + platform;\n}\nelse\n report_phrase = platform_name;\n\nvuln = FALSE;\n# Windows x86\nif (platform == 5)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.300.257';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n fixed_level = '8.1.15.254';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse if (platform == 18)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.0.3';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n if (level =~ '^8\\\\.1\\\\.0\\\\.') fixed_level = '8.1.0.136';\n else fixed_level = '8.1.2.136';\n\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse\n{\n info =\n 'Nessus does not support version checks against ' + report_phrase + '.\\n' +\n 'To help us better identify vulnerable versions, please send the platform\\n' +\n 'number along with details about the platform, including the operating system\\n' +\n 'version, CPU architecture, and DB2 version to db2-platform-info@nessus.org.\\n';\n exit(1, info);\n}\n\nif (vuln)\n{\n report_db2(\n severity : SECURITY_HOLE,\n port : port,\n platform_name : platform_name,\n installed_level : level,\n fixed_level : fixed_level);\n}\nelse exit(0, \"IBM DB2 \"+level+\" on \" + report_phrase + \" is listening on port \"+port+\" and is not affected.\");\n", "naslFamily": "Databases", "cpe": ["cpe:/a:ibm:db2"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2019-10-28T20:03:15", "differentElements": ["cvss3", "description", "modified"], "edition": 3}, {"bulletin": {"id": "DB2_9FP3.NASL", "hash": "93be7b86da2747e79f2436273d939f890a42ed9f750bc06659e4f1996d615d3c", "type": "nessus", "bulletinFamily": "scanner", "title": "IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities", "description": "According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.", "published": "2007-08-20T00:00:00", "modified": "2020-12-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/25905", "reporter": "This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://seclists.org/fulldisclosure/2007/Aug/317", "https://seclists.org/fulldisclosure/2007/Aug/318", "https://seclists.org/bugtraq/2007/Oct/153", "https://seclists.org/fulldisclosure/2007/Aug/313", "https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/", "https://www-01.ibm.com/support/docview.wss?uid=swg21255607", "https://seclists.org/fulldisclosure/2007/Aug/316", "https://seclists.org/fulldisclosure/2007/Aug/315", "https://seclists.org/fulldisclosure/2007/Aug/314", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "https://seclists.org/fulldisclosure/2007/Aug/319"], "cvelist": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "immutableFields": [], "lastseen": "2020-12-01T09:39:51", "history": [], "viewCount": 3, "enchantments": {"dependencies": {"modified": "2020-12-01T09:39:51", "references": [{"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_JDBC"], "type": "canvas"}, {"idList": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "type": "cve"}, {"idList": ["SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17838", "SECURITYVULNS:DOC:17836", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17835"], "type": "securityvulns"}, {"idList": ["ZDI-07-056"], "type": "zdi"}], "rev": 2}, "score": {"modified": "2020-12-01T09:39:51", "rev": 2, "value": 8.7, "vector": "NONE"}}, "objectVersion": "1.6", "pluginID": "25905", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25905);\n script_version(\"1.34\");\n script_cvs_date(\"Date: 2018/11/15 20:50:21\");\n\n script_cve_id(\"CVE-2007-2582\", \"CVE-2007-4270\", \"CVE-2007-4271\", \"CVE-2007-4272\",\n \"CVE-2007-4273\", \"CVE-2007-4275\", \"CVE-2007-4276\", \"CVE-2007-4417\", \"CVE-2007-4418\", \"CVE-2007-4423\");\n script_bugtraq_id(23890, 25339, 26010);\n\n script_name(english:\"IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities\");\n script_summary(english:\"Checks DB2 signature.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/316\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/319\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/bugtraq/2007/Oct/153\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www-01.ibm.com/support/docview.wss?uid=swg21255607\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8\nor later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(22, 119, 134);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/08/20\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:ibm:db2\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n \n script_copyright(english:\"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n \n script_dependencies(\"db2_das_detect.nasl\");\n script_require_ports(\"Services/db2das\", 523);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"db2_report_func.inc\");\n\nport = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);\n\nlevel = get_kb_item_or_exit(\"DB2/\"+port+\"/Level\");\nif (\n level !~ '^9\\\\.[01]\\\\.' &&\n level !~ '^([0-7]\\\\.|8\\\\.[01])'\n) exit(0, \"The version of IBM DB2 listening on port \"+port+\" is not 9.0, 9.1, or less than or equal to 8.1.x and thus is not affected.\");\n\nplatform = get_kb_item_or_exit(\"DB2/\"+port+\"/Platform\");\nplatform_name = get_kb_item(\"DB2/\"+port+\"/Platform_Name\");\nif (isnull(platform_name))\n{\n platform_name = platform;\n report_phrase = \"platform \" + platform;\n}\nelse\n report_phrase = platform_name;\n\nvuln = FALSE;\n# Windows x86\nif (platform == 5)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.300.257';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n fixed_level = '8.1.15.254';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse if (platform == 18)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.0.3';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n if (level =~ '^8\\\\.1\\\\.0\\\\.') fixed_level = '8.1.0.136';\n else fixed_level = '8.1.2.136';\n\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse\n{\n info =\n 'Nessus does not support version checks against ' + report_phrase + '.\\n' +\n 'To help us better identify vulnerable versions, please send the platform\\n' +\n 'number along with details about the platform, including the operating system\\n' +\n 'version, CPU architecture, and DB2 version to db2-platform-info@nessus.org.\\n';\n exit(1, info);\n}\n\nif (vuln)\n{\n report_db2(\n severity : SECURITY_HOLE,\n port : port,\n platform_name : platform_name,\n installed_level : level,\n fixed_level : fixed_level);\n}\nelse exit(0, \"IBM DB2 \"+level+\" on \" + report_phrase + \" is listening on port \"+port+\" and is not affected.\");\n", "naslFamily": "Databases", "cpe": ["cpe:/a:ibm:db2"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2020-12-01T09:39:51", "differentElements": ["cvss2", "cvss3", "modified"], "edition": 4}, {"bulletin": {"id": "DB2_9FP3.NASL", "hash": "56395978831d0991e8fe4bc1921746f0e2bcae6bdab58ba59e4122cccdd4e817", "type": "nessus", "bulletinFamily": "scanner", "title": "IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities", "description": "According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.", "published": "2007-08-20T00:00:00", "modified": "2021-07-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "href": "https://www.tenable.com/plugins/nessus/25905", "reporter": "This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://seclists.org/fulldisclosure/2007/Aug/317", "https://seclists.org/fulldisclosure/2007/Aug/318", "https://seclists.org/bugtraq/2007/Oct/153", "https://seclists.org/fulldisclosure/2007/Aug/313", "https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/", "https://www-01.ibm.com/support/docview.wss?uid=swg21255607", "https://seclists.org/fulldisclosure/2007/Aug/316", "https://seclists.org/fulldisclosure/2007/Aug/315", "https://seclists.org/fulldisclosure/2007/Aug/314", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "https://seclists.org/fulldisclosure/2007/Aug/319"], "cvelist": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "immutableFields": [], "lastseen": "2021-07-28T22:54:22", "history": [], "viewCount": 6, "enchantments": {"dependencies": {"modified": "2021-07-28T22:54:22", "references": [{"idList": ["SSV:2138"], "type": "seebug"}, {"idList": ["DB2_JDBC"], "type": "canvas"}, {"idList": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "type": "cve"}, {"idList": ["SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17838", "SECURITYVULNS:DOC:17836", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17835"], "type": "securityvulns"}, {"idList": ["ZDI-07-056"], "type": "zdi"}], "rev": 2}, "score": {"modified": "2021-07-28T22:54:22", "rev": 2, "value": 8.7, "vector": "NONE"}}, "objectVersion": "1.6", "pluginID": "25905", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25905);\n script_version(\"1.34\");\n script_cvs_date(\"Date: 2018/11/15 20:50:21\");\n\n script_cve_id(\"CVE-2007-2582\", \"CVE-2007-4270\", \"CVE-2007-4271\", \"CVE-2007-4272\",\n \"CVE-2007-4273\", \"CVE-2007-4275\", \"CVE-2007-4276\", \"CVE-2007-4417\", \"CVE-2007-4418\", \"CVE-2007-4423\");\n script_bugtraq_id(23890, 25339, 26010);\n\n script_name(english:\"IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities\");\n script_summary(english:\"Checks DB2 signature.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/316\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/319\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/bugtraq/2007/Oct/153\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www-01.ibm.com/support/docview.wss?uid=swg21255607\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8\nor later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(22, 119, 134);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/08/20\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:ibm:db2\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n \n script_copyright(english:\"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n \n script_dependencies(\"db2_das_detect.nasl\");\n script_require_ports(\"Services/db2das\", 523);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"db2_report_func.inc\");\n\nport = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);\n\nlevel = get_kb_item_or_exit(\"DB2/\"+port+\"/Level\");\nif (\n level !~ '^9\\\\.[01]\\\\.' &&\n level !~ '^([0-7]\\\\.|8\\\\.[01])'\n) exit(0, \"The version of IBM DB2 listening on port \"+port+\" is not 9.0, 9.1, or less than or equal to 8.1.x and thus is not affected.\");\n\nplatform = get_kb_item_or_exit(\"DB2/\"+port+\"/Platform\");\nplatform_name = get_kb_item(\"DB2/\"+port+\"/Platform_Name\");\nif (isnull(platform_name))\n{\n platform_name = platform;\n report_phrase = \"platform \" + platform;\n}\nelse\n report_phrase = platform_name;\n\nvuln = FALSE;\n# Windows x86\nif (platform == 5)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.300.257';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n fixed_level = '8.1.15.254';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse if (platform == 18)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.0.3';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n if (level =~ '^8\\\\.1\\\\.0\\\\.') fixed_level = '8.1.0.136';\n else fixed_level = '8.1.2.136';\n\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse\n{\n info =\n 'Nessus does not support version checks against ' + report_phrase + '.\\n' +\n 'To help us better identify vulnerable versions, please send the platform\\n' +\n 'number along with details about the platform, including the operating system\\n' +\n 'version, CPU architecture, and DB2 version to db2-platform-info@nessus.org.\\n';\n exit(1, info);\n}\n\nif (vuln)\n{\n report_db2(\n severity : SECURITY_HOLE,\n port : port,\n platform_name : platform_name,\n installed_level : level,\n fixed_level : fixed_level);\n}\nelse exit(0, \"IBM DB2 \"+level+\" on \" + report_phrase + \" is listening on port \"+port+\" and is not affected.\");\n", "naslFamily": "Databases", "cpe": ["cpe:/a:ibm:db2"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2021-07-28T22:54:22", "differentElements": ["modified"], "edition": 5}, {"bulletin": {"id": "DB2_9FP3.NASL", "hash": "82c843a62ac915295e6fa39ca7fab2aa", "type": "nessus", "bulletinFamily": "scanner", "title": "IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities", "description": "According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.", "published": "2007-08-20T00:00:00", "modified": "2021-08-02T00:00:00", "cvss": {"score": 10.0, "vector": "AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {"cvssV2": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 10.0, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 10.0, "obtainAllPrivilege": true, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "HIGH", "userInteractionRequired": false}, "cvss3": {}, "href": "https://www.tenable.com/plugins/nessus/25905", "reporter": "This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["https://seclists.org/fulldisclosure/2007/Aug/317", "https://seclists.org/fulldisclosure/2007/Aug/318", "https://seclists.org/bugtraq/2007/Oct/153", "https://seclists.org/fulldisclosure/2007/Aug/313", "https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/", "https://www-01.ibm.com/support/docview.wss?uid=swg21255607", "https://seclists.org/fulldisclosure/2007/Aug/316", "https://seclists.org/fulldisclosure/2007/Aug/315", "https://seclists.org/fulldisclosure/2007/Aug/314", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "https://seclists.org/fulldisclosure/2007/Aug/319"], "cvelist": ["CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4423", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4276"], "immutableFields": [], "lastseen": "2021-08-01T06:57:22", "history": [], "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "seebug", "idList": ["SSV:2138"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:17836", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17838", "SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17835", "SECURITYVULNS:DOC:17834"]}, {"type": "cve", "idList": ["CVE-2007-2582", "CVE-2007-4418", "CVE-2007-4275", "CVE-2007-4423", "CVE-2007-4270", "CVE-2007-4273", "CVE-2007-4276", "CVE-2007-4272", "CVE-2007-4417", "CVE-2007-4271"]}, {"type": "zdi", "idList": ["ZDI-07-056"]}, {"type": "canvas", "idList": ["DB2_JDBC"]}], "modified": "2021-08-01T06:57:22", "rev": 2}, "score": {"value": 8.7, "vector": "NONE", "modified": "2021-08-01T06:57:22", "rev": 2}}, "objectVersion": "1.6", "pluginID": "25905", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25905);\n script_version(\"1.34\");\n script_cvs_date(\"Date: 2018/11/15 20:50:21\");\n\n script_cve_id(\"CVE-2007-2582\", \"CVE-2007-4270\", \"CVE-2007-4271\", \"CVE-2007-4272\",\n \"CVE-2007-4273\", \"CVE-2007-4275\", \"CVE-2007-4276\", \"CVE-2007-4417\", \"CVE-2007-4418\", \"CVE-2007-4423\");\n script_bugtraq_id(23890, 25339, 26010);\n\n script_name(english:\"IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities\");\n script_summary(english:\"Checks DB2 signature.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/316\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/319\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/bugtraq/2007/Oct/153\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www-01.ibm.com/support/docview.wss?uid=swg21255607\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8\nor later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(22, 119, 134);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/08/20\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:ibm:db2\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n \n script_copyright(english:\"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n \n script_dependencies(\"db2_das_detect.nasl\");\n script_require_ports(\"Services/db2das\", 523);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"db2_report_func.inc\");\n\nport = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);\n\nlevel = get_kb_item_or_exit(\"DB2/\"+port+\"/Level\");\nif (\n level !~ '^9\\\\.[01]\\\\.' &&\n level !~ '^([0-7]\\\\.|8\\\\.[01])'\n) exit(0, \"The version of IBM DB2 listening on port \"+port+\" is not 9.0, 9.1, or less than or equal to 8.1.x and thus is not affected.\");\n\nplatform = get_kb_item_or_exit(\"DB2/\"+port+\"/Platform\");\nplatform_name = get_kb_item(\"DB2/\"+port+\"/Platform_Name\");\nif (isnull(platform_name))\n{\n platform_name = platform;\n report_phrase = \"platform \" + platform;\n}\nelse\n report_phrase = platform_name;\n\nvuln = FALSE;\n# Windows x86\nif (platform == 5)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.300.257';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n fixed_level = '8.1.15.254';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse if (platform == 18)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.0.3';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n if (level =~ '^8\\\\.1\\\\.0\\\\.') fixed_level = '8.1.0.136';\n else fixed_level = '8.1.2.136';\n\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse\n{\n info =\n 'Nessus does not support version checks against ' + report_phrase + '.\\n' +\n 'To help us better identify vulnerable versions, please send the platform\\n' +\n 'number along with details about the platform, including the operating system\\n' +\n 'version, CPU architecture, and DB2 version to db2-platform-info@nessus.org.\\n';\n exit(1, info);\n}\n\nif (vuln)\n{\n report_db2(\n severity : SECURITY_HOLE,\n port : port,\n platform_name : platform_name,\n installed_level : level,\n fixed_level : fixed_level);\n}\nelse exit(0, \"IBM DB2 \"+level+\" on \" + report_phrase + \" is listening on port \"+port+\" and is not affected.\");\n", "naslFamily": "Databases", "cpe": ["cpe:/a:ibm:db2"], "solution": "", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {}, "exploitAvailable": false, "exploitEase": "", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": []}, "lastseen": "2021-08-01T06:57:22", "differentElements": ["cpe", "cvss", "cvss2", "cvss3", "description", "exploitAvailable", "exploitEase", "exploitableWith", "modified", "references", "solution", "vpr"], "edition": 6}, {"bulletin": {"id": "DB2_9FP3.NASL", "hash": "122d0442103c97e91adb0c0e4e8c6b7e", "type": "nessus", "bulletinFamily": "scanner", "title": "IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities", "description": "According to its version, the installation of IBM DB2 running on the remote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files, create arbitrary world-writeable directories, or gain root privileges via symlink attacks or specially crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege elevation when DB2 'execs' executables while running as root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to incorrect authorization routines. (JR25940, version 8 only)\n\n - There is an unspecified vulnerability in 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 only)\n\n - There is an unspecified vulnerability in the 'db2licm' and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE' environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF' environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code execution without the need for authentication due to a stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service issues that can be triggered by packets with an invalid LANG parameter or a long packet, which cause the process to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to what extent the first set of issues overlaps the others.", "published": "2007-08-20T00:00:00", "modified": "2018-11-15T00:00:00", "cvss": {"score": 10, "vector": "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/25905", "reporter": "This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4272", "https://seclists.org/fulldisclosure/2007/Aug/319", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2582", "https://seclists.org/fulldisclosure/2007/Aug/318", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "https://seclists.org/fulldisclosure/2007/Aug/315", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4275", "https://seclists.org/fulldisclosure/2007/Aug/313", "https://www-01.ibm.com/support/docview.wss?uid=swg21255607", "https://seclists.org/bugtraq/2007/Oct/153", "https://seclists.org/fulldisclosure/2007/Aug/316", "https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4417", "https://seclists.org/fulldisclosure/2007/Aug/314", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4418", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4276", "https://seclists.org/fulldisclosure/2007/Aug/317", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4273", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4423", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4271", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4270"], "cvelist": ["CVE-2007-2582", "CVE-2007-4270", "CVE-2007-4271", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4275", "CVE-2007-4276", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4423"], "immutableFields": [], "lastseen": "2021-08-12T13:18:43", "history": [], "viewCount": 7, "enchantments": {"dependencies": {"references": [{"type": "seebug", "idList": ["SSV:2138"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:17838", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17835", "SECURITYVULNS:DOC:17836", "SECURITYVULNS:VULN:8068"]}, {"type": "cve", "idList": ["CVE-2007-4418", "CVE-2007-4423", "CVE-2007-4276", "CVE-2007-4275", "CVE-2007-4273", "CVE-2007-2582", "CVE-2007-4272", "CVE-2007-4271", "CVE-2007-4270", "CVE-2007-4417"]}, {"type": "zdi", "idList": ["ZDI-07-056"]}, {"type": "canvas", "idList": ["DB2_JDBC"]}, {"type": "nessus", "idList": ["4239.PRM"]}], "modified": "2021-08-12T13:18:43", "rev": 2}, "score": {"value": 8.7, "vector": "NONE", "modified": "2021-08-12T13:18:43", "rev": 2}}, "objectVersion": "1.6", "pluginID": "25905", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25905);\n script_version(\"1.34\");\n script_cvs_date(\"Date: 2018/11/15 20:50:21\");\n\n script_cve_id(\"CVE-2007-2582\", \"CVE-2007-4270\", \"CVE-2007-4271\", \"CVE-2007-4272\",\n \"CVE-2007-4273\", \"CVE-2007-4275\", \"CVE-2007-4276\", \"CVE-2007-4417\", \"CVE-2007-4418\", \"CVE-2007-4423\");\n script_bugtraq_id(23890, 25339, 26010);\n\n script_name(english:\"IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities\");\n script_summary(english:\"Checks DB2 signature.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/316\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/319\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/bugtraq/2007/Oct/153\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www-01.ibm.com/support/docview.wss?uid=swg21255607\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8\nor later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(22, 119, 134);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/08/20\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:ibm:db2\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n \n script_copyright(english:\"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n \n script_dependencies(\"db2_das_detect.nasl\");\n script_require_ports(\"Services/db2das\", 523);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"db2_report_func.inc\");\n\nport = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);\n\nlevel = get_kb_item_or_exit(\"DB2/\"+port+\"/Level\");\nif (\n level !~ '^9\\\\.[01]\\\\.' &&\n level !~ '^([0-7]\\\\.|8\\\\.[01])'\n) exit(0, \"The version of IBM DB2 listening on port \"+port+\" is not 9.0, 9.1, or less than or equal to 8.1.x and thus is not affected.\");\n\nplatform = get_kb_item_or_exit(\"DB2/\"+port+\"/Platform\");\nplatform_name = get_kb_item(\"DB2/\"+port+\"/Platform_Name\");\nif (isnull(platform_name))\n{\n platform_name = platform;\n report_phrase = \"platform \" + platform;\n}\nelse\n report_phrase = platform_name;\n\nvuln = FALSE;\n# Windows x86\nif (platform == 5)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.300.257';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n fixed_level = '8.1.15.254';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse if (platform == 18)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.0.3';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n if (level =~ '^8\\\\.1\\\\.0\\\\.') fixed_level = '8.1.0.136';\n else fixed_level = '8.1.2.136';\n\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse\n{\n info =\n 'Nessus does not support version checks against ' + report_phrase + '.\\n' +\n 'To help us better identify vulnerable versions, please send the platform\\n' +\n 'number along with details about the platform, including the operating system\\n' +\n 'version, CPU architecture, and DB2 version to db2-platform-info@nessus.org.\\n';\n exit(1, info);\n}\n\nif (vuln)\n{\n report_db2(\n severity : SECURITY_HOLE,\n port : port,\n platform_name : platform_name,\n installed_level : level,\n fixed_level : fixed_level);\n}\nelse exit(0, \"IBM DB2 \"+level+\" on \" + report_phrase + \" is listening on port \"+port+\" and is not affected.\");\n", "naslFamily": "Databases", "cpe": ["cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*"], "solution": "Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8 or later.", "nessusSeverity": "", "cvssScoreSource": "", "vpr": {"risk factor": "High", "score": "7.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": ["CANVAS: CANVAS"]}, "lastseen": "2021-08-12T13:18:43", "differentElements": ["exploitableWith", "nessusSeverity"], "edition": 7}, {"bulletin": {"id": "DB2_9FP3.NASL", "hash": "0c8229a162634869fb1c84623d52badc", "type": "nessus", "bulletinFamily": "scanner", "title": "IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities", "description": "According to its version, the installation of IBM DB2 running on the remote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files, create arbitrary world-writeable directories, or gain root privileges via symlink attacks or specially crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege elevation when DB2 'execs' executables while running as root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to incorrect authorization routines. (JR25940, version 8 only)\n\n - There is an unspecified vulnerability in 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 only)\n\n - There is an unspecified vulnerability in the 'db2licm' and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE' environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF' environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code execution without the need for authentication due to a stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service issues that can be triggered by packets with an invalid LANG parameter or a long packet, which cause the process to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to what extent the first set of issues overlaps the others.", "published": "2007-08-20T00:00:00", "modified": "2018-11-15T00:00:00", "cvss": {"score": 10, "vector": "CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C"}, "cvss2": {}, "cvss3": {"score": 9.8, "vector": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}, "href": "https://www.tenable.com/plugins/nessus/25905", "reporter": "This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.", "references": ["http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4273", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4272", "https://seclists.org/fulldisclosure/2007/Aug/317", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4271", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4275", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4417", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4423", "https://seclists.org/fulldisclosure/2007/Aug/313", "https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4418", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-2582", "https://seclists.org/fulldisclosure/2007/Aug/314", "https://seclists.org/fulldisclosure/2007/Aug/315", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4276", "https://seclists.org/bugtraq/2007/Oct/153", "https://www-01.ibm.com/support/docview.wss?uid=swg21255607", "http://www-1.ibm.com/support/docview.wss?uid=swg21255352", "https://seclists.org/fulldisclosure/2007/Aug/318", "https://seclists.org/fulldisclosure/2007/Aug/316", "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-4270", "https://seclists.org/fulldisclosure/2007/Aug/319"], "cvelist": ["CVE-2007-2582", "CVE-2007-4270", "CVE-2007-4271", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4275", "CVE-2007-4276", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4423"], "immutableFields": [], "lastseen": "2021-08-19T13:13:37", "history": [], "viewCount": 11, "enchantments": {"dependencies": {"references": [{"type": "seebug", "idList": ["SSV:2138"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:DOC:17836", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17835", "SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17838"]}, {"type": "cve", "idList": ["CVE-2007-4418", "CVE-2007-4275", "CVE-2007-2582", "CVE-2007-4272", "CVE-2007-4276", "CVE-2007-4423", "CVE-2007-4270", "CVE-2007-4417", "CVE-2007-4271", "CVE-2007-4273"]}, {"type": "canvas", "idList": ["DB2_JDBC"]}, {"type": "zdi", "idList": ["ZDI-07-056"]}, {"type": "nessus", "idList": ["4239.PRM"]}], "modified": "2021-08-19T13:13:37", "rev": 2}, "score": {"value": 8.7, "vector": "NONE", "modified": "2021-08-19T13:13:37", "rev": 2}}, "objectVersion": "1.6", "pluginID": "25905", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25905);\n script_version(\"1.34\");\n script_cvs_date(\"Date: 2018/11/15 20:50:21\");\n\n script_cve_id(\"CVE-2007-2582\", \"CVE-2007-4270\", \"CVE-2007-4271\", \"CVE-2007-4272\",\n \"CVE-2007-4273\", \"CVE-2007-4275\", \"CVE-2007-4276\", \"CVE-2007-4417\", \"CVE-2007-4418\", \"CVE-2007-4423\");\n script_bugtraq_id(23890, 25339, 26010);\n\n script_name(english:\"IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities\");\n script_summary(english:\"Checks DB2 signature.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/316\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/319\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/bugtraq/2007/Oct/153\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www-01.ibm.com/support/docview.wss?uid=swg21255607\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8\nor later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(22, 119, 134);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/08/20\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:ibm:db2\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n \n script_copyright(english:\"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n \n script_dependencies(\"db2_das_detect.nasl\");\n script_require_ports(\"Services/db2das\", 523);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"db2_report_func.inc\");\n\nport = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);\n\nlevel = get_kb_item_or_exit(\"DB2/\"+port+\"/Level\");\nif (\n level !~ '^9\\\\.[01]\\\\.' &&\n level !~ '^([0-7]\\\\.|8\\\\.[01])'\n) exit(0, \"The version of IBM DB2 listening on port \"+port+\" is not 9.0, 9.1, or less than or equal to 8.1.x and thus is not affected.\");\n\nplatform = get_kb_item_or_exit(\"DB2/\"+port+\"/Platform\");\nplatform_name = get_kb_item(\"DB2/\"+port+\"/Platform_Name\");\nif (isnull(platform_name))\n{\n platform_name = platform;\n report_phrase = \"platform \" + platform;\n}\nelse\n report_phrase = platform_name;\n\nvuln = FALSE;\n# Windows x86\nif (platform == 5)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.300.257';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n fixed_level = '8.1.15.254';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse if (platform == 18)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.0.3';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n if (level =~ '^8\\\\.1\\\\.0\\\\.') fixed_level = '8.1.0.136';\n else fixed_level = '8.1.2.136';\n\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse\n{\n info =\n 'Nessus does not support version checks against ' + report_phrase + '.\\n' +\n 'To help us better identify vulnerable versions, please send the platform\\n' +\n 'number along with details about the platform, including the operating system\\n' +\n 'version, CPU architecture, and DB2 version to db2-platform-info@nessus.org.\\n';\n exit(1, info);\n}\n\nif (vuln)\n{\n report_db2(\n severity : SECURITY_HOLE,\n port : port,\n platform_name : platform_name,\n installed_level : level,\n fixed_level : fixed_level);\n}\nelse exit(0, \"IBM DB2 \"+level+\" on \" + report_phrase + \" is listening on port \"+port+\" and is not affected.\");\n", "naslFamily": "Databases", "cpe": ["cpe:2.3:a:ibm:db2:*:*:*:*:*:*:*:*"], "solution": "Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8 or later.", "nessusSeverity": "Critical", "cvssScoreSource": "", "vpr": {"risk factor": "High", "score": "7.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": ["CANVAS(CANVAS)"]}, "lastseen": "2021-08-19T13:13:37", "differentElements": ["cpe", "cvss"], "edition": 8}], "viewCount": 11, "enchantments": {"dependencies": {"references": [{"type": "seebug", "idList": ["SSV:2138"]}, {"type": "securityvulns", "idList": ["SECURITYVULNS:VULN:8068", "SECURITYVULNS:DOC:17834", "SECURITYVULNS:DOC:17833", "SECURITYVULNS:DOC:17838", "SECURITYVULNS:DOC:17835", "SECURITYVULNS:DOC:17837", "SECURITYVULNS:DOC:17836"]}, {"type": "cve", "idList": ["CVE-2007-4276", "CVE-2007-4270", "CVE-2007-2582", "CVE-2007-4275", "CVE-2007-4271", "CVE-2007-4417", "CVE-2007-4418", "CVE-2007-4272", "CVE-2007-4273", "CVE-2007-4423"]}, {"type": "canvas", "idList": ["DB2_JDBC"]}, {"type": "zdi", "idList": ["ZDI-07-056"]}, {"type": "nessus", "idList": ["4239.PRM"]}], "modified": "2021-10-16T03:02:54", "rev": 2}, "score": {"value": 8.7, "vector": "NONE", "modified": "2021-10-16T03:02:54", "rev": 2}}, "objectVersion": "1.6", "pluginID": "25905", "sourceData": "#\n# (C) Tenable Network Security, Inc.\n#\n\ninclude(\"compat.inc\");\n\nif (description)\n{\n script_id(25905);\n script_version(\"1.34\");\n script_cvs_date(\"Date: 2018/11/15 20:50:21\");\n\n script_cve_id(\"CVE-2007-2582\", \"CVE-2007-4270\", \"CVE-2007-4271\", \"CVE-2007-4272\",\n \"CVE-2007-4273\", \"CVE-2007-4275\", \"CVE-2007-4276\", \"CVE-2007-4417\", \"CVE-2007-4418\", \"CVE-2007-4423\");\n script_bugtraq_id(23890, 25339, 26010);\n\n script_name(english:\"IBM DB2 < 9 Fix Pack 3 / 8 Fix Pack 15 Multiple Vulnerabilities\");\n script_summary(english:\"Checks DB2 signature.\");\n\n script_set_attribute(attribute:\"synopsis\", value:\n\"The remote database server is affected by multiple vulnerabilities.\");\n script_set_attribute(attribute:\"description\", value:\n\"According to its version, the installation of IBM DB2 running on the\nremote host is affected by one or more of the following issues :\n\n - A local user may be able to overwrite arbitrary files,\n create arbitrary world-writeable directories, or gain\n root privileges via symlink attacks or specially\n crafted environment variables. (IY98210 / IY99261)\n\n - A user may be able to continue to execute a method even \n once privileges for the method have been revoked.\n (IY88226, version 8 only)\n\n - There is an unspecified issue allowing for privilege\n elevation when DB2 'execs' executables while running as \n root. (IY98206 / IY98176)\n\n - There is an unspecified vulnerability related to\n incorrect authorization routines. (JR25940, version 8\n only)\n\n - There is an unspecified vulnerability in \n 'AUTH_LIST_GROUPS_FOR_AUTHID'. (IZ01828, version 9.1 \n only)\n\n - There is an unspecified vulnerability in the 'db2licm'\n and 'db2pd' tools. (IY97922 / IY97936)\n\n - There is an unspecified vulnerability involving\n 'db2licd' and the 'OSSEMEMDBG' and 'TRC_LOG_FILE'\n environment variables. (IY98011 / IY98101)\n\n - There is a buffer overflow involving the 'DASPROF'\n environment variable. (IY97346 / IY99311)\n\n - There is an unspecified vulnerability that can arise \n during instance and FMP startup. (IZ01923 / IZ02067)\n\n - The DB2JDS service may allow for arbitrary code\n execution without the need for authentication due to a\n stack overflow in an internal sprintf() call.\n (IY97750, version 8 only)\n\n - The DB2JDS service is affected by two denial of service\n issues that can be triggered by packets with an invalid\n LANG parameter or a long packet, which cause the process\n to terminate (version 8 only).\n\nNote that there is currently insufficient information to determine to\nwhat extent the first set of issues overlaps the others.\" );\n script_set_attribute(attribute:\"see_also\", value:\"https://www.trustwave.com/Company/AppSecInc-is-now-Trustwave/\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/313\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/314\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/315\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/316\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/317\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/318\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/fulldisclosure/2007/Aug/319\");\n script_set_attribute(attribute:\"see_also\", value:\"https://seclists.org/bugtraq/2007/Oct/153\");\n script_set_attribute(attribute:\"see_also\", value:\"https://www-01.ibm.com/support/docview.wss?uid=swg21255607\");\n script_set_attribute(attribute:\"see_also\", value:\"http://www-1.ibm.com/support/docview.wss?uid=swg21255352\");\n script_set_attribute(attribute:\"solution\", value:\n\"Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8\nor later.\");\n script_set_cvss_base_vector(\"CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C\");\n script_set_cvss_temporal_vector(\"CVSS2#E:F/RL:OF/RC:C\");\n script_set_cvss3_base_vector(\"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\");\n script_set_cvss3_temporal_vector(\"CVSS:3.0/E:F/RL:O/RC:C\");\n script_set_attribute(attribute:\"exploitability_ease\", value:\"Exploits are available\");\n script_set_attribute(attribute:\"exploit_available\", value:\"true\");\n script_set_attribute(attribute:\"exploit_framework_canvas\", value:\"true\");\n script_set_attribute(attribute:\"canvas_package\", value:'CANVAS');\n script_cwe_id(22, 119, 134);\n\n script_set_attribute(attribute:\"plugin_publication_date\", value: \"2007/08/20\");\n script_set_attribute(attribute:\"plugin_type\", value:\"remote\");\n script_set_attribute(attribute:\"cpe\", value:\"cpe:/a:ibm:db2\");\n script_end_attributes();\n \n script_category(ACT_GATHER_INFO);\n script_family(english:\"Databases\");\n \n script_copyright(english:\"This script is Copyright (C) 2007-2018 and is owned by Tenable, Inc. or an Affiliate thereof.\");\n \n script_dependencies(\"db2_das_detect.nasl\");\n script_require_ports(\"Services/db2das\", 523);\n\n exit(0);\n}\n\ninclude(\"global_settings.inc\");\ninclude(\"misc_func.inc\");\ninclude(\"db2_report_func.inc\");\n\nport = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);\n\nlevel = get_kb_item_or_exit(\"DB2/\"+port+\"/Level\");\nif (\n level !~ '^9\\\\.[01]\\\\.' &&\n level !~ '^([0-7]\\\\.|8\\\\.[01])'\n) exit(0, \"The version of IBM DB2 listening on port \"+port+\" is not 9.0, 9.1, or less than or equal to 8.1.x and thus is not affected.\");\n\nplatform = get_kb_item_or_exit(\"DB2/\"+port+\"/Platform\");\nplatform_name = get_kb_item(\"DB2/\"+port+\"/Platform_Name\");\nif (isnull(platform_name))\n{\n platform_name = platform;\n report_phrase = \"platform \" + platform;\n}\nelse\n report_phrase = platform_name;\n\nvuln = FALSE;\n# Windows x86\nif (platform == 5)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.300.257';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n fixed_level = '8.1.15.254';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse if (platform == 18)\n{\n if (level =~ '^9\\\\.')\n {\n fixed_level = '9.1.0.3';\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n else\n {\n if (level =~ '^8\\\\.1\\\\.0\\\\.') fixed_level = '8.1.0.136';\n else fixed_level = '8.1.2.136';\n\n if (ver_compare(ver:level, fix:fixed_level) == -1)\n vuln = TRUE;\n }\n}\nelse\n{\n info =\n 'Nessus does not support version checks against ' + report_phrase + '.\\n' +\n 'To help us better identify vulnerable versions, please send the platform\\n' +\n 'number along with details about the platform, including the operating system\\n' +\n 'version, CPU architecture, and DB2 version to db2-platform-info@nessus.org.\\n';\n exit(1, info);\n}\n\nif (vuln)\n{\n report_db2(\n severity : SECURITY_HOLE,\n port : port,\n platform_name : platform_name,\n installed_level : level,\n fixed_level : fixed_level);\n}\nelse exit(0, \"IBM DB2 \"+level+\" on \" + report_phrase + \" is listening on port \"+port+\" and is not affected.\");\n", "naslFamily": "Databases", "cpe": ["cpe:/a:ibm:db2"], "solution": "Apply IBM DB2 version 9 Fix Pack 3 / 8.1 Fix Pack 15 / 8.2 Fix Pack 8 or later.", "nessusSeverity": "Critical", "cvssScoreSource": "", "vpr": {"risk factor": "High", "score": "7.4"}, "exploitAvailable": true, "exploitEase": "Exploits are available", "patchPublicationDate": null, "vulnerabilityPublicationDate": null, "exploitableWith": ["CANVAS(CANVAS)"], "_object_type": "robots.models.nessus.NessusBulletin", "_object_types": ["robots.models.nessus.NessusBulletin", "robots.models.base.Bulletin"]}]}