Vulnerability CVE-2014-8910 - CERT Civis.Net

Vulnerability Name:

CVE-2014-8910 (CCN-99251)

Assigned:

2014-11-14

Published:

2015-07-10

Updated:

2017-09-22

Summary:

IBM DB2 9.7 through FP10, 9.8 through FP5, 10.1 before FP5, and 10.5 through FP5 on Linux, UNIX, and Windows allows remote authenticated users to read arbitrary text files via a crafted XML/XSLT function in a SELECT statement.

CVSS v3 Severity:

3.5 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:N/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): Required
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): None Availibility (A): None

CVSS v2 Severity:

4.0 Medium (CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
3.0 Low (Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Authentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
3.0 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N/E:U/RL:OF/RC:C)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): Single_Instance
Impact Metrics:	Confidentiality (C): Partial Integrity (I): None Availibility (A): None

Vulnerability Type:

Vulnerability Consequences:

Obtain Information

References:

Source: MITRE
Type: CNA
CVE-2014-8910

Source: AIXAPAR
Type: UNKNOWN
IT06353

Source: AIXAPAR
Type: Vendor Advisory
IT06354

Source: AIXAPAR
Type: UNKNOWN
IT06355

Source: AIXAPAR
Type: UNKNOWN
IT06356

Source: CONFIRM
Type: Patch, Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21697988

Source: CCN
Type: IBM Security Bulletin 1697988
IBM DB2 contains a file disclosure vulnerability using a SELECT statement with XML/XSLT function (CVE-2014-8910)

Source: CCN
Type: IBM Security Bulletin 1966964
Infosphere BigInsights is affected by multiple IBM DB2 advisories (CVE-2014-8910, CVE-2015-1883, CVE-2015-1922, CVE-2015-1935).

Source: BID
Type: UNKNOWN
75949

Source: CCN
Type: BID-75949
Multiple IBM DB2 Products CVE-2014-8910 File Disclosure Vulnerability

Source: SECTRACK
Type: UNKNOWN
1032883

Source: XF
Type: UNKNOWN
ibm-db2-cve20148910-info-disc(99251)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:db2:9.7:*:*:*:advanced_enterprise:*:*:*

OR cpe:/a:ibm:db2:9.7:*:*:*:advanced_workgroup:*:*:*

OR cpe:/a:ibm:db2:9.7:*:*:*:enterprise:*:*:*

OR cpe:/a:ibm:db2:9.7:*:*:*:express:*:*:*

OR cpe:/a:ibm:db2:9.7:*:*:*:workgroup:*:*:*

OR cpe:/a:ibm:db2:9.8:*:*:*:advanced_enterprise:*:*:*

OR cpe:/a:ibm:db2:9.8:*:*:*:advanced_workgroup:*:*:*

OR cpe:/a:ibm:db2:9.8:*:*:*:enterprise:*:*:*

OR cpe:/a:ibm:db2:9.8:*:*:*:express:*:*:*

OR cpe:/a:ibm:db2:9.8:*:*:*:workgroup:*:*:*

OR cpe:/a:ibm:db2:10.1:*:*:*:advanced_enterprise:*:*:*

OR cpe:/a:ibm:db2:10.1:*:*:*:advanced_workgroup:*:*:*

OR cpe:/a:ibm:db2:10.1:*:*:*:enterprise:*:*:*

OR cpe:/a:ibm:db2:10.1:*:*:*:express:*:*:*

OR cpe:/a:ibm:db2:10.1:*:*:*:workgroup:*:*:*

OR cpe:/a:ibm:db2:10.5:*:*:*:advanced_enterprise:*:*:*

OR cpe:/a:ibm:db2:10.5:*:*:*:advanced_workgroup:*:*:*

OR cpe:/a:ibm:db2:10.5:*:*:*:enterprise:*:*:*

OR cpe:/a:ibm:db2:10.5:*:*:*:express:*:*:*

OR cpe:/a:ibm:db2:10.5:*:*:*:workgroup:*:*:*

Denotes that component is vulnerable

Oval Definitions

Definition ID	Class	Title	Last Modified
oval:com.ubuntu.precise:def:20148910000	V	CVE-2014-8910 on Ubuntu 12.04 LTS (precise) - low.	2015-07-19