Vulnerability CVE-2008-4693 - CERT Civis.Net

Vulnerability Name:

CVE-2008-4693 (CCN-46022)

Assigned:

2008-10-21

Published:

2008-10-21

Updated:

2017-08-08

Summary:

The SORT/LIST SERVICES component in IBM DB2 9.1 before FP6 and 9.5 before FP2 writes sensitive information to the trace output, which allows attackers to obtain sensitive information by reading "PASSWORD-RELATED CONNECTION STRING KEYWORD VALUES."

CVSS v3 Severity:

5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

5.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
3.7 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: CONFIRM
Type: UNKNOWN
ftp://ftp.software.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v91/APARLIST.TXT

Source: MITRE
Type: CNA
CVE-2008-4693

Source: CCN
Type: SA32368
IBM DB2 Multiple Vulnerabilities

Source: SECUNIA
Type: UNKNOWN
32368

Source: AIXAPAR
Type: UNKNOWN
IZ23915

Source: AIXAPAR
Type: UNKNOWN
IZ28489

Source: CCN
Type: IBM APAR IZ23915
SECURITY: PASSWORD-RELATED CONNECTION STRING KEYWORD VALUES MAY APPEAR IN TRACE OUTPUT.

Source: CCN
Type: IBM Support & downloads
Security Vulnerabilities and HIPER APARs fixed in DB2 for Linux, UNIX, and Windows Version 9.1 Fix Pack 6

Source: CONFIRM
Type: UNKNOWN
http://www-01.ibm.com/support/docview.wss?uid=swg27013892

Source: CCN
Type: OSVDB ID: 49950
IBM DB2 Universal Database SORT/LIST SERVICES Component Trace Output Information Disclosure

Source: CCN
Type: BID-31856
IBM DB2 Universal Database Prior to 9.1 Fixpak 6 Multiple Vulnerabilities

Source: VUPEN
Type: UNKNOWN
ADV-2008-2893

Source: XF
Type: UNKNOWN
ibm-db2-sortlist-info-disclosure(46022)

Source: XF
Type: UNKNOWN
ibm-db2-sortlist-info-disclosure(46022)

Source: CCN
Type: IBM Security Bulletin 6347588 (Security Guardium)
IBM Security Guardium is affected by multiple vulnerabilities

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:db2:9.1:-:*:*:*:*:*:*

OR cpe:/a:ibm:db2:9.1:fp1:*:*:*:*:*:*

OR cpe:/a:ibm:db2:9.1:fp2:*:*:*:*:*:*

OR cpe:/a:ibm:db2:9.1:fp3:*:*:*:*:*:*

OR cpe:/a:ibm:db2:9.1:fp3a:*:*:*:*:*:*

OR cpe:/a:ibm:db2:9.1:fp4:*:*:*:*:*:*

OR cpe:/a:ibm:db2:9.1:fp4a:*:*:*:*:*:*

OR cpe:/a:ibm:db2:*:fp5:*:*:*:*:*:* (Version <= 9.1)

OR cpe:/a:ibm:db2:9.5:-:*:*:*:*:*:*

OR cpe:/a:ibm:db2:*:fp1:*:*:*:*:*:* (Version <= 9.5)

Configuration CCN 1:

cpe:/a:ibm:db2_universal_database:9.1::aix:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1::hp-ux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1::linux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1::solaris:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1::windows:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp2:aix:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp2:hp-ux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp2:linux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp2:solaris:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp2:windows:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp3:aix:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp3:hp-ux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp3:linux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp3:solaris:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp3:windows:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4:aix:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4:hp-ux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4:linux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4:solaris:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4:windows:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:aix:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:hp-ux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:linux:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:solaris:*:*:*:*:*

OR cpe:/a:ibm:db2_universal_database:9.1:fp4a:windows:*:*:*:*:*

AND

cpe:/a:ibm:security_guardium:11.0:*:*:*:*:*:*:*

OR cpe:/a:ibm:security_guardium:11.1:*:*:*:*:*:*:*

Denotes that component is vulnerable