Vulnerability CVE-2013-4033 - CERT Civis.Net

Vulnerability Name:

CVE-2013-4033 (CCN-86093)

Assigned:

2013-08-22

Published:

2013-08-22

Updated:

2017-08-29

Summary:

IBM DB2 and DB2 Connect 9.7 through FP8, 9.8 through FP5, 10.1 through FP2, and 10.5 through FP1 allow remote authenticated users to execute DML statements by leveraging EXPLAIN authority.

CVSS v3 Severity:

5.5 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

4.6 Medium (CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P)
3.4 Low (Temporal CVSS v2 Vector: AV:N/AC:H/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

6.5 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P)
4.8 Medium (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Type:

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2013-4033

Source: CCN
Type: SA55580
IBM Smart Analytics System Series DB2 Unspecified Security Bypass Vulnerability

Source: CCN
Type: SA55600
IBM InfoSphere Balanced Warehouse Series DB2 Unspecified Security Bypass Vulnerability

Source: AIXAPAR
Type: UNKNOWN
IC94523

Source: AIXAPAR
Type: UNKNOWN
IC94756

Source: AIXAPAR
Type: UNKNOWN
IC94757

Source: AIXAPAR
Type: UNKNOWN
IC94758

Source: CCN
Type: IBM Security Bulletin 1646809
Unauthorized Access to Table Vulnerability in DB2 (CVE-2013-4033)

Source: CONFIRM
Type: Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21646809

Source: CCN
Type: IBM Security Bulletin 1649473
IBM InfoSphere Balanced Warehouse C3000, C4000, and D5100 and IBM Smart Analytics System 1050, 2050, 5600, 5710, 7600, 7700 and 7710 are affected by an unauthorized access to table vulnerability in IBM DB2 (CVE-2013-4033)

Source: CCN
Type: BID-62018
IBM DB2 and DB2 Connect CVE-2013-4033 Multiple Unauthorized Access Vulnerabilities

Source: XF
Type: UNKNOWN
db2-cve20134033-priv-esc(86093)

Source: XF
Type: UNKNOWN
db2-explain-cve20134033-priv-esc(86093)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:db2:9.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2:9.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2:10.1:*:*:*:*:-:*:*

OR cpe:/a:ibm:db2:10.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2_connect:9.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2_connect:9.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2_connect:9.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2_connect:10.1:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2_connect:10.5:*:*:*:*:*:*:*

Configuration CCN 1:

cpe:/a:ibm:db2:9.7:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2:10.1:*:*:*:*:-:*:*

OR cpe:/a:ibm:db2:9.8:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2:10.5::~~enterprise_server~~~:*:*:*:*:*

OR cpe:/a:ibm:db2:10.5::~~advanced_enterprise_server~~~:*:*:*:*:*

Denotes that component is vulnerable