Vulnerability Name:

CVE-2008-4692 (CCN-46021)

Assigned:2008-10-21
Published:2008-10-21
Updated:2017-08-08
Summary:The Native Managed Provider for .NET component in IBM DB2 8 before FP17, 9.1 before FP6, and 9.5 before FP2, when a definer cannot maintain objects, preserves views and triggers without marking them inoperative or dropping them, which has unknown impact and attack vectors.
CVSS v3 Severity:5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): None
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): None
Integrity (I): Low
Availibility (A): None
CVSS v2 Severity:10.0 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C)
7.4 High (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (Au): None
Impact Metrics:Confidentiality (C): Complete
Integrity (I): Complete
Availibility (A): Complete
5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:N/I:P/A:N/E:U/RL:OF/RC:C)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): None
Impact Metrics:Confidentiality (C): None
Integrity (I): Partial
Availibility (A): None
Vulnerability Type:CWE-noinfo
Vulnerability Consequences:Other
References:Source: CONFIRM
Type: UNKNOWN
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT

Source: MITRE
Type: CNA
CVE-2008-4692

Source: CCN
Type: SA31787
IBM DB2 Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
31787

Source: CCN
Type: SA32368
IBM DB2 Multiple Vulnerabilities

Source: SECUNIA
Type: Vendor Advisory
32368

Source: AIXAPAR
Type: UNKNOWN
IZ22287

Source: AIXAPAR
Type: UNKNOWN
IZ22306

Source: AIXAPAR
Type: UNKNOWN
IZ22307

Source: CCN
Type: IBM APAR IZ22306
SECURITY: VIEWS AND TRIGGERS SHOULD BE MARKED INOPERATIVE OR DROPPED IF DEFINER CANNOT MAINTAIN THE OBJECTS.

Source: CCN
Type: IBM Support & downloads
Security Vulnerabilities and HIPER APARs fixed in DB2 for Linux, UNIX, and Windows Version 9.1 Fix Pack 6

Source: CONFIRM
Type: UNKNOWN
http://www-01.ibm.com/support/docview.wss?uid=swg27013892

Source: CCN
Type: OSVDB ID: 49949
IBM DB2 Universal Database Native Managed Provider for .NET Object Maintenance Unspecified Issue

Source: CCN
Type: BID-31856
IBM DB2 Universal Database Prior to 9.1 Fixpak 6 Multiple Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2008-2893

Source: XF
Type: UNKNOWN
ibm-db2-native-managed-unspecified(46021)

Source: XF
Type: UNKNOWN
ibm-db2-native-managed-unspecified(46021)

Source: CCN
Type: IBM Security Bulletin 6347588 (Security Guardium)
IBM Security Guardium is affected by multiple vulnerabilities

Source: CCN
Type: IBM Security Bulletin 6349177 (Security Guardium)
IBM Security Guardium is affected by a DB2 jar vulnerability

Vulnerable Configuration:Configuration 1:
  • cpe:/a:ibm:db2:8.0:fp1:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp10:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp11:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp12:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp13:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp14:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp15:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:*:fp16:*:*:*:*:*:* (Version <= 8.0)
  • OR cpe:/a:ibm:db2:8.0:fp2:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp3:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp4:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp4a:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp5:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp6:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp6a:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp6b:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp6c:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp7:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp7a:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp7b:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp8:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp8a:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp9:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:8.0:fp9a:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:9.1:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:9.1:fp1:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:9.1:fp2:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:9.1:fp3:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:9.1:fp3a:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:9.1:fp4:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:9.1:fp4a:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:*:fp5:*:*:*:*:*:* (Version <= 9.1)
  • OR cpe:/a:ibm:db2:9.5:-:*:*:*:*:*:*
  • OR cpe:/a:ibm:db2:*:fp1:*:*:*:*:*:* (Version <= 9.5)

    • Configuration CCN 1:
  • cpe:/a:ibm:db2_universal_database:9.1::aix:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1::hp-ux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1::linux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1::solaris:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1::windows:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp2:aix:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp2:hp-ux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp2:linux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp2:solaris:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp2:windows:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp3:aix:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp3:hp-ux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp3:linux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp3:solaris:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp3:windows:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4:aix:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4:hp-ux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4:linux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4:solaris:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4:windows:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:aix:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:hp-ux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:linux:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:solaris:*:*:*:*:*
  • OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:windows:*:*:*:*:*
  • AND
  • cpe:/a:ibm:security_guardium:11.0:*:*:*:*:*:*:*
  • OR cpe:/a:ibm:security_guardium:11.1:*:*:*:*:*:*:*

    • * Denotes that component is vulnerable
    BACK
    ibm db2 8.0 fp1
    ibm db2 8.0 fp10
    ibm db2 8.0 fp11
    ibm db2 8.0 fp12
    ibm db2 8.0 fp13
    ibm db2 8.0 fp14
    ibm db2 8.0 fp15
    ibm db2 * fp16
    ibm db2 8.0 fp2
    ibm db2 8.0 fp3
    ibm db2 8.0 fp4
    ibm db2 8.0 fp4a
    ibm db2 8.0 fp5
    ibm db2 8.0 fp6
    ibm db2 8.0 fp6a
    ibm db2 8.0 fp6b
    ibm db2 8.0 fp6c
    ibm db2 8.0 fp7
    ibm db2 8.0 fp7a
    ibm db2 8.0 fp7b
    ibm db2 8.0 fp8
    ibm db2 8.0 fp8a
    ibm db2 8.0 fp9
    ibm db2 8.0 fp9a
    ibm db2 9.1
    ibm db2 9.1 fp1
    ibm db2 9.1 fp2
    ibm db2 9.1 fp3
    ibm db2 9.1 fp3a
    ibm db2 9.1 fp4
    ibm db2 9.1 fp4a
    ibm db2 * fp5
    ibm db2 9.5
    ibm db2 * fp1
    ibm db2 universal database 9.1
    ibm db2 universal database 9.1
    ibm db2 universal database 9.1
    ibm db2 universal database 9.1
    ibm db2 universal database 9.1
    ibm db2 universal database 9.1 fp2
    ibm db2 universal database 9.1 fp2
    ibm db2 universal database 9.1 fp2
    ibm db2 universal database 9.1 fp2
    ibm db2 universal database 9.1 fp2
    ibm db2 universal database 9.1 fp3
    ibm db2 universal database 9.1 fp3
    ibm db2 universal database 9.1 fp3
    ibm db2 universal database 9.1 fp3
    ibm db2 universal database 9.1 fp3
    ibm db2 universal database 9.1 fp4
    ibm db2 universal database 9.1 fp4
    ibm db2 universal database 9.1 fp4
    ibm db2 universal database 9.1 fp4
    ibm db2 universal database 9.1 fp4
    ibm db2 universal database 9.1 fp4a
    ibm db2 universal database 9.1 fp4a
    ibm db2 universal database 9.1 fp4a
    ibm db2 universal database 9.1 fp4a
    ibm db2 universal database 9.1 fp4a
    ibm security guardium 11.0
    ibm security guardium 11.1