Vulnerabilities > CVE-2008-4692 - Remote Security vulnerability in DB2
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
COMPLETE Integrity impact
COMPLETE Availability impact
COMPLETE Summary
The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors.
Vulnerable Configurations
Part | Description | Count |
---|---|---|
Application | 37 |
Nessus
NASL family Databases NASL id DB2_95FP2.NASL description The installation of IBM DB2 9.5 running on the remote host does not have Fix Pack 2 applied. It is, therefore, affected by the following issues : - DB2 does not mark inoperative or drop views and triggers if the definer cannot maintain the objects (IZ22307). - Password-related connection string keyword values may appear in trace output (IZ28489). - There is an unspecified vulnerability in the way CLR Stored Procedures for Visual Studio from IBM database add-ins are deployed (JR28431). - There is an unspecified buffer overflow in DAS server code (IZ22190). - INSTALL_JAR can be used to create or overwrite critical files on a system (IZ22143). - On Windows, the db2fmp process is running with OS privileges (JR30227). last seen 2020-06-01 modified 2020-06-02 plugin id 34056 published 2008-08-28 reporter This script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34056 title IBM DB2 9.5 < Fix Pack 2 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(34056); script_version("1.22"); script_cvs_date("Date: 2018/07/06 11:26:06"); script_cve_id("CVE-2008-2154", "CVE-2008-3852", "CVE-2008-4693", "CVE-2008-4692", "CVE-2008-6821"); script_bugtraq_id(30859, 35408, 35409); script_xref(name:"Secunia", value:"31635"); script_name(english:"IBM DB2 9.5 < Fix Pack 2 Multiple Vulnerabilities"); script_summary(english:"Checks DB2 signature."); script_set_attribute(attribute:"synopsis", value: "The remote database server is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "The installation of IBM DB2 9.5 running on the remote host does not have Fix Pack 2 applied. It is, therefore, affected by the following issues : - DB2 does not mark inoperative or drop views and triggers if the definer cannot maintain the objects (IZ22307). - Password-related connection string keyword values may appear in trace output (IZ28489). - There is an unspecified vulnerability in the way CLR Stored Procedures for Visual Studio from IBM database add-ins are deployed (JR28431). - There is an unspecified buffer overflow in DAS server code (IZ22190). - INSTALL_JAR can be used to create or overwrite critical files on a system (IZ22143). - On Windows, the db2fmp process is running with OS privileges (JR30227)."); script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg21293566"); script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22307"); script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ28489"); script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1JR28431"); script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22190"); script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22143"); script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1JR30227"); script_set_attribute(attribute:"solution", value:"Apply IBM DB2 version 9.5 Fix Pack 2."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(16, 119, 200, 264); script_set_attribute(attribute:"plugin_publication_date", value: "2008/08/28"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:db2"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Databases"); script_copyright(english:"This script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("db2_das_detect.nasl"); script_require_ports("Services/db2das", 523); exit(0); } include("global_settings.inc"); include("misc_func.inc"); include("db2_report_func.inc"); port = get_service(svc:'db2das', default:523, exit_on_fail:TRUE); level = get_kb_item_or_exit("DB2/" + port + "/Level"); if (level !~ '^9\\.5\\.') exit(0, "The version of IBM DB2 listening on port "+port+" is not 9.5 and thus is not affected."); platform = get_kb_item_or_exit("DB2/"+port+"/Platform"); platform_name = get_kb_item("DB2/"+port+"/Platform_Name"); if (isnull(platform_name)) { platform_name = platform; report_phrase = "platform " + platform; } else report_phrase = platform_name; vuln = FALSE; # Windows 32-bit if (platform == 5) { fixed_level = '9.5.200.315'; if (ver_compare(ver:level, fix:fixed_level) == -1) vuln = TRUE; } # Linux, 2.6 Kernel 32-bit else if (platform == 18) { fixed_level = '9.5.0.2'; if (ver_compare(ver:level, fix:fixed_level) == -1) vuln = TRUE; } else { info = 'Nessus does not support version checks against ' + report_phrase + '.\n' + 'To help us better identify vulnerable versions, please send the platform\n' + 'number along with details about the platform, including the operating system\n' + 'version, CPU architecture, and DB2 version to [email protected].\n'; exit(1, info); } if (vuln) { report_db2( severity : SECURITY_HOLE, port : port, platform_name : platform_name, installed_level : level, fixed_level : fixed_level); } exit(0, "IBM DB2 "+level+" on " + report_phrase + " is listening on port "+port+" and is not affected.");
NASL family Databases NASL id DB2_9FP6.NASL description According to its version, the installation of IBM DB2 9.1 running on the remote host is affected by one or more of the following issues : - An unspecified error in last seen 2020-06-01 modified 2020-06-02 plugin id 34475 published 2008-10-22 reporter This script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/34475 title IBM DB2 9.1 < Fix Pack 6 Multiple Vulnerabilities code # # (C) Tenable Network Security, Inc. # include("compat.inc"); if (description) { script_id(34475); script_version("1.16"); script_cvs_date("Date: 2018/07/06 11:26:06"); script_cve_id("CVE-2008-4691", "CVE-2008-4692", "CVE-2008-4693"); script_bugtraq_id(31856); script_xref(name:"Secunia", value:"32368"); script_name(english:"IBM DB2 9.1 < Fix Pack 6 Multiple Vulnerabilities"); script_summary(english:"Checks DB2 signature."); script_set_attribute(attribute:"synopsis", value: "The remote database server is affected by multiple vulnerabilities."); script_set_attribute(attribute:"description", value: "According to its version, the installation of IBM DB2 9.1 running on the remote host is affected by one or more of the following issues : - An unspecified error in 'SQLNLS_UNPADDEDCHARLEN()' may lead to a segmentation fault in the DB2 server. (LI73364) - DB2 does not mark inoperative or drop views and triggers if the definer cannot maintain the objects. (IZ22306) - Password-related connection string keyword values may appear in trace output. (IZ23915)"); script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg27013892"); script_set_attribute(attribute:"solution", value: "Apply IBM DB2 version 9.1 Fix Pack 6 or later."); script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P"); script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C"); script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L"); script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C"); script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available"); script_set_attribute(attribute:"exploit_available", value:"false"); script_cwe_id(200); script_set_attribute(attribute:"plugin_publication_date", value: "2008/10/22"); script_set_attribute(attribute:"plugin_type", value:"remote"); script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:db2"); script_end_attributes(); script_category(ACT_GATHER_INFO); script_family(english:"Databases"); script_copyright(english:"This script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof."); script_dependencies("db2_das_detect.nasl"); script_require_ports("Services/db2das", 523); exit(0); } include("global_settings.inc"); include("misc_func.inc"); include("db2_report_func.inc"); port = get_service(svc:'db2das', default:523, exit_on_fail:TRUE); level = get_kb_item_or_exit("DB2/"+port+"/Level"); if (level !~ '^9\\.[01]\\.') exit(0, "The version of IBM DB2 listening on port "+port+" is not 9.0 or 9.1 and thus is not affected."); platform = get_kb_item_or_exit("DB2/"+port+"/Platform"); platform_name = get_kb_item("DB2/"+port+"/Platform_Name"); if (isnull(platform_name)) { platform_name = platform; report_phrase = "platform " + platform; } else report_phrase = platform_name; vuln = FALSE; # Windows 32-bit if (platform == 5) { fixed_level = '9.1.600.703'; if (ver_compare(ver:level, fix:fixed_level) == -1) vuln = TRUE; } # Linux, 2.6 Kernel 32-bit else if (platform == 18) { fixed_level = '9.1.0.6'; if (ver_compare(ver:level, fix:fixed_level) == -1) vuln = TRUE; } else { info = 'Nessus does not support version checks against ' + report_phrase + '.\n' + 'To help us better identify vulnerable versions, please send the platform\n' + 'number along with details about the platform, including the operating system\n' + 'version, CPU architecture, and DB2 version to [email protected].\n'; exit(1, info); } if (vuln) { report_db2( severity : SECURITY_HOLE, port : port, platform_name : platform_name, installed_level : level, fixed_level : fixed_level); } else exit(0, "IBM DB2 "+level+" on " + report_phrase + " is listening on port "+port+" and is not affected.");
References
- ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT
- http://secunia.com/advisories/31787
- http://secunia.com/advisories/32368
- http://www.vupen.com/english/advisories/2008/2893
- http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22287
- http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22306
- http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22307
- http://www-01.ibm.com/support/docview.wss?uid=swg27013892
- https://exchange.xforce.ibmcloud.com/vulnerabilities/46021