IBM DB2 Multiple Symlink Attacks Let Local Users Gain Elevated Privileges
|
|
SecurityTracker Alert ID: 1042086 |
|
SecurityTracker URL: http://securitytracker.com/id/1042086
|
|
CVE Reference:
CVE-2018-1780, CVE-2018-1781, CVE-2018-1799, CVE-2018-1834
(Links to External Site)
|
Date: Nov 12 2018
|
Impact:
Root access via local system
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): 9.7, 10.1, 10.5, 11.1
|
Description:
Several vulnerabilities were reported in IBM DB2. A local user can obtain elevated privileges on the target system.
A local user can overwrite files on the target system to execute arbitrary commands with elevated privileges. This can be exploited to gain root privileges.
Eddie Zhu, BEIJING DBSEC TECHNOLOGY CO., LTD. reported these vulnerabilities.
|
Impact:
A local user can obtain elevated privileges on the target system.
|
Solution:
IBM has issued a fix.
For 9.7: APARs IT26142, IT26135, IT26141, IT26318
For 10.1: APARs IT26140, IT26134, IT26139, IT26317
For 10.5: APARs IT26137, IT26133, IT26136, IT26316
For 11.1: APARs IT26131, IT26129, IT26130, IT26315
The IBM advisory is available at:
https://www-01.ibm.com/support/docview.wss?uid=ibm10733939
|
Vendor URL: www-01.ibm.com/support/docview.wss?uid=ibm10733939 (Links to External Site)
|
Cause:
Access control error
|
Underlying OS: Linux (Any), UNIX (AIX), UNIX (HP/UX), UNIX (Solaris - SunOS)
|
|
Message History:
None.
|
Source Message Contents
|
|
|
[Original Message Not Available for Viewing]
|
|
