DB2 - Problembeschreibung
Problem IC99478 | Status: Geschlossen |
SECURITY: VULNERABILITY IN STORED PROCEDURE INFRASTRUCTURE CAN ALLOW ESCALATION OF PRIVILEGE TO ADMINISTRATOR (CVE-2013-6744). | |
Produkt: | |
DB2 FOR LUW / DB2FORLUW / 970 - DB2 | |
Problembeschreibung: | |
There is a security vulnerability in the Stored Procedure Infrastructure that will allow a malicious user to gain administrator privilege on the server. This vulnerability is only applicable to DB2 on Windows. To exploit the vulnerability, the DB2 user will need to have CREATE_EXTERNAL_ROUTINE privilege which is by default not granted to PUBLIC. See security bulletin for details: http://www.ibm.com/support/docview.wss?uid=swg21673947 | |
Problem-Zusammenfassung: | |
**************************************************************** * USERS AFFECTED: * * All DB2 Servers on Windows platforms at service levels from * * Version 9.7 GA through to Version 9.7 Fix Pack 9. * **************************************************************** * PROBLEM DESCRIPTION: * * See Error Description * **************************************************************** * RECOMMENDATION: * * Upgrade to DB2 Version 9.7 Fix Pack 9a or see "Local Fix" * * portion for other suggestions. * **************************************************************** | |
Local-Fix: | |
Revoke CREATE_EXTERNAL_ROUTINE from all users and only grant the privilege to trusted users. | |
verfügbare FixPacks: | |
DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows | |
Lösung | |
The complete fix for this problem first appears in DB2 Version 9.7 Fix Pack 9a and all the subsequent Fix Packs. | |
Workaround | |
keiner bekannt / siehe Local-Fix | |
Weitere Daten | |
Datum - Problem gemeldet : Datum - Problem geschlossen : Datum - der letzten Änderung: | 19.02.2014 30.06.2014 30.06.2014 |
Problem behoben ab folgender Versionen (IBM BugInfos) | |
9.7.FP9 | |
Problem behoben lt. FixList in der Version | |
9.7.0.10 |