IBM DB2 DBADM Privilege Revocation Security Bypass Vulnerability

  1. Network Vulnerabilities
  2. Databases
  3. IBM DB2 DBADM Privilege Revocation Security Bypass Vulnerability
Summary
The host is running IBM DB2 and is prone to security bypass vulnerability.
Impact
Successful exploitation allows remote authenticated users to execute non-DDL statements by leveraging previous possession of this authority. Impact Level: Application.
Solution
Upgrade to IBM DB2 version 9.1 FP10, 9.5 FP6a, 9.7 FP2 or later, http://www-01.ibm.com/support/docview.wss?rs=71&uid=swg27007053
Insight
The flaw is due to an error in the application while revoking 'DBADM' privileges. This does not restrict users from executing non-DDL statements.
Affected
IBM DB2 version 9.1 before FP10, IBM DB2 version 9.5 before FP6a and IBM DB2 version 9.7 before FP2
References
Updated on 2017-03-28
Severity
Medium Severity
Classification
Related Vulnerabilities