| Vulnerability Name: | CVE-2012-0709 (CCN-73493) | ||||||||||||
| Assigned: | 2012-03-16 | ||||||||||||
| Published: | 2012-03-16 | ||||||||||||
| Updated: | 2017-09-19 | ||||||||||||
| Summary: | IBM DB2 9.5 before FP9, 9.7 through FP5, and 9.8 through FP4 does not properly check variables, which allows remote authenticated users to bypass intended restrictions on viewing table data by leveraging the CREATEIN privilege to execute crafted SQL CREATE VARIABLE statements. | ||||||||||||
| CVSS v3 Severity: | 3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)
| ||||||||||||
| CVSS v2 Severity: | 4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N) 3.5 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:H/RL:OF/RC:C)
3.5 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:H/RL:OF/RC:C)
| ||||||||||||
| Vulnerability Type: | CWE-20 | ||||||||||||
| Vulnerability Consequences: | Bypass Security | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2012-0709 Source: CCN Type: SA48279 IBM DB2 Multiple Vulnerabilities Source: AIXAPAR Type: UNKNOWN IC81387 Source: AIXAPAR Type: UNKNOWN IC81390 Source: AIXAPAR Type: UNKNOWN IC81836 Source: CCN Type: IBM Security Bulletin 1588100 Security Bulletin: Unauthorized Access to Table Vulnerability in DB2 (CVE-2012-0709) Source: CONFIRM Type: Vendor Advisory http://www-01.ibm.com/support/docview.wss?uid=swg21588100 Source: CCN Type: OSVDB ID: 79846 IBM DB2 Authorization Checks Table Information Disclosure Source: CCN Type: BID-52326 IBM DB2 Multiple Security Vulnerabilities Source: XF Type: UNKNOWN db2-createvariable-security-bypass(73493) Source: XF Type: UNKNOWN db2-createvariable-security-bypass(73493) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:15004 | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||