IBM DB2 dasauto Command Lets Local Users Deny Service
|
|
SecurityTracker Alert ID: 1023242 |
|
SecurityTracker URL: http://securitytracker.com/id?1023242
|
|
CVE Reference:
CVE-2009-4150
(Links to External Site)
|
Updated: Dec 5 2009
|
Original Entry Date: Nov 26 2009
|
Impact:
Denial of service via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 8, 9.1, 9.5, 9.7
|
Description:
A vulnerability was reported in IBM DB2. A local user can cause denial of service conditions.
A local user can invoke the dasauto command to enable or disable auto-starting of the DB2 administration server.
Only Linux/UNIX-based systems are affected.
|
Impact:
A local user can cause disable the DB2 administration server from autostarting.
|
Solution:
The vendor has issued a fix (APARs IZ40343, IZ40340, IZ40352, IC64759; V8 FP18, V9.1 FP8, V9.5 FP4, V9.7 FP1).
The vendor's advisory is available at:
http://www-01.ibm.com/support/docview.wss?uid=swg21386689
|
Vendor URL: www-01.ibm.com/support/docview.wss?uid=swg21386689 (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS)
|
|
Message History:
None.
|
Source Message Contents
|
Date: Thu, 26 Nov 2009 20:46:27 +0000
Subject: IBM DB2
|
APAR IC64759 DASAUTO COMMAND CAN BE RUN BY NON-PRIVILEGED USERS
|
|
