Vulnerabilities > CVE-2008-4692 - Remote Security vulnerability in DB2

047910
CVSS 10.0 - CRITICAL
Attack vector
NETWORK
Attack complexity
LOW
Privileges required
NONE
Confidentiality impact
COMPLETE
Integrity impact
COMPLETE
Availability impact
COMPLETE
network
low complexity
ibm
critical
nessus

Summary

The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors.

Vulnerable Configurations

Part Description Count
Application
Ibm
37

Nessus

  • NASL familyDatabases
    NASL idDB2_95FP2.NASL
    descriptionThe installation of IBM DB2 9.5 running on the remote host does not have Fix Pack 2 applied. It is, therefore, affected by the following issues : - DB2 does not mark inoperative or drop views and triggers if the definer cannot maintain the objects (IZ22307). - Password-related connection string keyword values may appear in trace output (IZ28489). - There is an unspecified vulnerability in the way CLR Stored Procedures for Visual Studio from IBM database add-ins are deployed (JR28431). - There is an unspecified buffer overflow in DAS server code (IZ22190). - INSTALL_JAR can be used to create or overwrite critical files on a system (IZ22143). - On Windows, the db2fmp process is running with OS privileges (JR30227).
    last seen2020-06-01
    modified2020-06-02
    plugin id34056
    published2008-08-28
    reporterThis script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34056
    titleIBM DB2 9.5 < Fix Pack 2 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(34056);
      script_version("1.22");
      script_cvs_date("Date: 2018/07/06 11:26:06");
    
      script_cve_id("CVE-2008-2154", "CVE-2008-3852", "CVE-2008-4693", "CVE-2008-4692", "CVE-2008-6821");
      script_bugtraq_id(30859, 35408, 35409);
      script_xref(name:"Secunia", value:"31635");
    
      script_name(english:"IBM DB2 9.5 < Fix Pack 2 Multiple Vulnerabilities");
      script_summary(english:"Checks DB2 signature.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote database server is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "The installation of IBM DB2 9.5 running on the remote host does not
    have Fix Pack 2 applied. It is, therefore, affected by the following
    issues :
    
      - DB2 does not mark inoperative or drop views and triggers
        if the definer cannot maintain the objects (IZ22307).
    
      - Password-related connection string keyword values may
        appear in trace output (IZ28489).
    
      - There is an unspecified vulnerability in the way CLR 
        Stored Procedures for Visual Studio from IBM database 
        add-ins are deployed (JR28431). 
    
      - There is an unspecified buffer overflow in DAS server
        code (IZ22190).
    
      - INSTALL_JAR can be used to create or overwrite critical
        files on a system (IZ22143).
    
      - On Windows, the db2fmp process is running with OS
        privileges (JR30227).");
      script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg21293566");
      script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22307");
      script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ28489");
      script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1JR28431");
      script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22190");
      script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1IZ22143");
      script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg1JR30227");
      script_set_attribute(attribute:"solution", value:"Apply IBM DB2 version 9.5 Fix Pack 2.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(16, 119, 200, 264);
    
      script_set_attribute(attribute:"plugin_publication_date", value: "2008/08/28");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:db2");
      script_end_attributes();
     
      script_category(ACT_GATHER_INFO);
      script_family(english:"Databases");
     
      script_copyright(english:"This script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
     
      script_dependencies("db2_das_detect.nasl");
      script_require_ports("Services/db2das", 523);
    
      exit(0);
    }
    
    include("global_settings.inc");
    include("misc_func.inc");
    include("db2_report_func.inc");
    
    port = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);
    
    level = get_kb_item_or_exit("DB2/" + port + "/Level");
    if (level !~ '^9\\.5\\.') exit(0, "The version of IBM DB2 listening on port "+port+" is not 9.5 and thus is not affected.");
    
    platform = get_kb_item_or_exit("DB2/"+port+"/Platform");
    platform_name = get_kb_item("DB2/"+port+"/Platform_Name");
    if (isnull(platform_name))
    {
      platform_name = platform;
      report_phrase = "platform " + platform;
    }
    else
      report_phrase = platform_name;
    
    vuln = FALSE;
    # Windows 32-bit
    if (platform == 5)
    {
      fixed_level = '9.5.200.315';
      if (ver_compare(ver:level, fix:fixed_level) == -1)
        vuln = TRUE;
    }
    # Linux, 2.6 Kernel 32-bit
    else if (platform == 18)
    {
      fixed_level = '9.5.0.2';
      if (ver_compare(ver:level, fix:fixed_level) == -1)
        vuln = TRUE;
    }
    else
    {
      info =
        'Nessus does not support version checks against ' + report_phrase + '.\n' +
        'To help us better identify vulnerable versions, please send the platform\n' +
        'number along with details about the platform, including the operating system\n' +
        'version, CPU architecture, and DB2 version to [email protected].\n';
      exit(1, info);
    }
    
    if (vuln)
    {
      report_db2(
          severity        : SECURITY_HOLE,
          port            : port,
          platform_name   : platform_name,
          installed_level : level,
          fixed_level     : fixed_level);
    }
    exit(0, "IBM DB2 "+level+" on " + report_phrase + " is listening on port "+port+" and is not affected.");
    
  • NASL familyDatabases
    NASL idDB2_9FP6.NASL
    descriptionAccording to its version, the installation of IBM DB2 9.1 running on the remote host is affected by one or more of the following issues : - An unspecified error in
    last seen2020-06-01
    modified2020-06-02
    plugin id34475
    published2008-10-22
    reporterThis script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof.
    sourcehttps://www.tenable.com/plugins/nessus/34475
    titleIBM DB2 9.1 < Fix Pack 6 Multiple Vulnerabilities
    code
    #
    # (C) Tenable Network Security, Inc.
    #
    
    include("compat.inc");
    
    if (description)
    {
      script_id(34475);
      script_version("1.16");
      script_cvs_date("Date: 2018/07/06 11:26:06");
    
      script_cve_id("CVE-2008-4691", "CVE-2008-4692", "CVE-2008-4693");
      script_bugtraq_id(31856);
      script_xref(name:"Secunia", value:"32368");
    
      script_name(english:"IBM DB2 9.1 < Fix Pack 6 Multiple Vulnerabilities");
      script_summary(english:"Checks DB2 signature.");
    
      script_set_attribute(attribute:"synopsis", value:
    "The remote database server is affected by multiple vulnerabilities.");
      script_set_attribute(attribute:"description", value:
    "According to its version, the installation of IBM DB2 9.1 running on
    the remote host is affected by one or more of the following issues :
    
      - An unspecified error in 'SQLNLS_UNPADDEDCHARLEN()' may
        lead to a segmentation fault in the DB2 server.
        (LI73364)
    
      - DB2 does not mark inoperative or drop views and triggers
        if the definer cannot maintain the objects. (IZ22306)
    
      - Password-related connection string keyword values may
        appear in trace output. (IZ23915)");
      script_set_attribute(attribute:"see_also", value:"http://www-01.ibm.com/support/docview.wss?uid=swg27013892");
      script_set_attribute(attribute:"solution", value:
    "Apply IBM DB2 version 9.1 Fix Pack 6 or later.");
      script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P");
      script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
      script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L");
      script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
      script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
      script_set_attribute(attribute:"exploit_available", value:"false");
      script_cwe_id(200);
    
      script_set_attribute(attribute:"plugin_publication_date", value: "2008/10/22");
      script_set_attribute(attribute:"plugin_type", value:"remote");
      script_set_attribute(attribute:"cpe", value:"cpe:/a:ibm:db2");
      script_end_attributes();
     
      script_category(ACT_GATHER_INFO);
      script_family(english:"Databases");
     
      script_copyright(english:"This script is Copyright (C) 2008-2018 and is owned by Tenable, Inc. or an Affiliate thereof.");
     
      script_dependencies("db2_das_detect.nasl");
      script_require_ports("Services/db2das", 523);
    
      exit(0);
    }
    
    include("global_settings.inc");
    include("misc_func.inc");
    include("db2_report_func.inc");
    
    port = get_service(svc:'db2das', default:523, exit_on_fail:TRUE);
    
    level = get_kb_item_or_exit("DB2/"+port+"/Level");
    if (level !~ '^9\\.[01]\\.') exit(0, "The version of IBM DB2 listening on port "+port+" is not 9.0 or 9.1 and thus is not affected.");
    
    platform = get_kb_item_or_exit("DB2/"+port+"/Platform");
    platform_name = get_kb_item("DB2/"+port+"/Platform_Name");
    if (isnull(platform_name))
    {
      platform_name = platform;
      report_phrase = "platform " + platform;
    }
    else
      report_phrase = platform_name;
    
    
    vuln = FALSE;
    # Windows 32-bit
    if (platform == 5)
    {
      fixed_level = '9.1.600.703';
      if (ver_compare(ver:level, fix:fixed_level) == -1)
        vuln = TRUE;
    }
    # Linux, 2.6 Kernel 32-bit
    else if (platform == 18)
    {
      fixed_level = '9.1.0.6';
      if (ver_compare(ver:level, fix:fixed_level) == -1)
        vuln = TRUE;
    }
    else
    {
      info = 
        'Nessus does not support version checks against ' + report_phrase + '.\n' +
        'To help us better identify vulnerable versions, please send the platform\n' +
        'number along with details about the platform, including the operating system\n' +
        'version, CPU architecture, and DB2 version to [email protected].\n';
      exit(1, info);
    }
    
    if (vuln)
    {
      report_db2(
          severity        : SECURITY_HOLE,
          port            : port,
          platform_name   : platform_name,
          installed_level : level,
          fixed_level     : fixed_level);
    }
    else exit(0, "IBM DB2 "+level+" on " + report_phrase + " is listening on port "+port+" and is not affected.");