CVE-2017-1452
HighSummary
IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1 (including DB2 Connect Server) could allow a local user to obtain elevated privileges and overwrite DB2 files.
Risk Assessment
This vulnerability poses a risk to the integrity of the system, as a local user could make unauthorized changes to DB2 files.
Recommendation
It is recommended to upgrade to the latest version of DB2 and implement appropriate access controls to limit the ability of local users to gain elevated privileges.
Other vulnerabilities in IBM DB2 for Linux, UNIX and Windows
See all- CVE-2017-1451High
IBM DB2 for Linux, UNIX and Windows versions 9.7, 10.1, 10.5, and 11.1 may allow a local user with DB2 instance owner privileges to gain root access.
- CVE-2017-1297High
IBM DB2 for Linux, UNIX and Windows versions 9.2, 10.1, 10.5, and 11.1 is vulnerable to a stack-based buffer overflow, caused by improper bounds checking which could allow a local attacker to execute arbitrary code.
- CVE-2017-1105High
IBM DB2 for Linux, UNIX and Windows versions 9.2, 10.1, 10.5, and 11.1 is vulnerable to a buffer overflow that could allow a local user to overwrite DB2 files or cause a denial of service.
- CVE-2023-35012Medium
IBM Db2 for Linux, UNIX and Windows version 11.5 with a Federated configuration is vulnerable to a stack-based buffer overflow, caused by improper bounds checking. A local user with SYSADM privileges could overflow the buffer and execute arbitrary code on the system.
Original NVD description (English source)
IBM DB2 for Linux, UNIX and Windows 9.7, 10,1, 10.5, and 11.1 (includes DB2 Connect Server) could allow a local user to obtain elevated privilege and overwrite DB2 files. IBM X-Force ID: 128180.