|
Problem IC70406
|
Status: Geschlossen |
SECURITY: UPDATE AGAINST A TABLE VIA A COMPOUND SQL (COMPILED) STATEMENT MAY BE EXECUTED BY USER WTHOUT REQUIRED PRIVILEGES |
| Produkt: |
DB2 FOR LUW / DB2FORLUW / 970 - DB2 |
| Problembeschreibung: |
If a compound SQL (compiled) statement has been issued by a user
that is properly authorized, this is cached in the dynamic SQL
cache. Once cached, this same query can be executed by any
user if that user has the proper authority.
In this case, there is a bug when the compound SQL (compiled)
statement includes an update statement against a table. In
this case once the statement has been compiled (via a prepare or
execute immediate request) by a user with the required update
privilege on the table, then a user that does not have update
privilege on the table issuing the same statement might be able
to resolve to the cached entry and successfully execute the
query.
The problem only applies to update privileges, compound SQL
(compiled) statements and statements that have already been
cached. |
| Problem-Zusammenfassung: |
****************************************************************
* USERS AFFECTED: *
* compound SQL (compiled) statements with table updates *
****************************************************************
* PROBLEM DESCRIPTION: *
* unauthorized user able to issue cached compound SQL *
* (compiled) statement with update statement *
****************************************************************
* RECOMMENDATION: *
* move to DB2 for LUW version 9, fixpack 3 *
**************************************************************** |
| Local-Fix: |
Avoid update statements in compound SQL (compiled) statements |
| verfügbare FixPacks: |
DB2 Version 9.7 Fix Pack 3 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 3a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 4 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 5 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 6 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 7 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 8 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 10 for Linux, UNIX, and Windows
|
| Lösung |
Fixed in DB2 for LUW version 9, fixpack 3 |
| Workaround |
keiner bekannt / siehe Local-Fix |
| Bug-Verfolgung |
Vorgänger : APAR is sysrouted TO one or more of the following: IC70408
Nachfolger : |
| Weitere Daten |
Datum - Problem gemeldet :
Datum - Problem geschlossen :
Datum - der letzten Änderung:
| 05.08.2010
14.09.2010
14.09.2010 |
| Problem behoben ab folgender Versionen (IBM BugInfos) |
9.0.FP3
|
| Problem behoben lt. FixList in der Version |
| 9.7.0.3
|
 |
| 9.7.0.3
|
|
