Lucene search

MitreCVE-2007-4417

HistoryAug 18, 2007 - 9:17 p.m.

CVE-2007-4417

2007-08-1821:17:00

mitre

web.nvd.nist.gov

ibm

db2

udb

privilege revocation

method execution

cache flush

security vulnerability

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

6.4

Confidence

Low

EPSS

0.005

Percentile

76.9%

JSON

IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 does not properly revoke privileges on methods, which allows remote authenticated users to execute a method after revocation until the routine auth cache is flushed.

Affected configurations

Nvd

Node

ibmdb2_universal_databaseRange≤8.0fp14

ibmdb2_universal_databaseRange≤9.1fp2

VendorProductVersionCPE
ibmdb2_universal_database*cpe:2.3:a:ibm:db2_universal_database:*:fp14:*:*:*:*:*:*
ibmdb2_universal_database*cpe:2.3:a:ibm:db2_universal_database:*:*:fp2:*:*:*:*:*

Vendor	Product	Version	CPE
ibm	db2_universal_database	*	cpe:2.3:a:ibm:db2_universal_database::fp14::::::*
ibm	db2_universal_database	*	cpe:2.3:a:ibm:db2_universal_database:::fp2:::::*

References

secunia.com/advisories/26471

www-1.ibm.com/support/docview.wss?uid=swg1IY88158

www-1.ibm.com/support/docview.wss?uid=swg1IY88226

www-1.ibm.com/support/docview.wss?uid=swg21255352

www-1.ibm.com/support/docview.wss?uid=swg21255607

www.attrition.org/pipermail/vim/2007-August/001765.html

www.securityfocus.com/bid/25339

www.vupen.com/english/advisories/2007/2912

exchange.xforce.ibmcloud.com/vulnerabilities/36108

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:S/C:P/I:P/A:P

AI Score

6.4

Confidence

Low

EPSS

0.005

Percentile

76.9%

JSON

Related for CVE-2007-4417