Vulnerability CVE-2018-1710

Vulnerability Name:

CVE-2018-1710 (CCN-146364)

Assigned:

2017-12-13

Published:

2018-09-18

Updated:

2019-03-21

Summary:

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 tool db2licm is affected by buffer overflow vulnerability that can potentially result in arbitrary code execution. IBM X-Force ID: 146364.

CVSS v3 Severity:

7.8 High (CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
6.8 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): Low User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C)

Exploitability Metrics:	Attack Vector (AV): Local Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): High Integrity (I): High Availibility (A): High

CVSS v2 Severity:

4.6 Medium (CVSS v2 Vector: AV:L/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Authentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)

Exploitability Metrics:	Access Vector (AV): Local Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Complete Integrity (I): Complete Availibility (A): Complete

Vulnerability Type:

CWE-119

Vulnerability Consequences:

Gain Privileges

References:

Source: MITRE
Type: CNA
CVE-2018-1710

Source: CCN
Type: IBM Security Bulletin 881778 (VRA - Vyatta 5600)
Vyatta 5600 vRouter Software Patches - Release 1801-v

Source: BID
Type: Third Party Advisory, VDB Entry
105391

Source: CCN
Type: BID-105391
IBM DB2 CVE-2018-1710 Local Buffer Overflow Vulnerability

Source: XF
Type: UNKNOWN
ibm-db2-cve20181710-bo(146364)

Source: XF
Type: VDB Entry, Vendor Advisory
ibm-db2-cve20181710-bo(146364)

Source: UBUNTU
Type: UNKNOWN
USN-3906-2

Source: CCN
Type: IBM Security Bulletin 729981 (DB2 for Linux, UNIX and Windows)
Buffer overflow in IBM Db2 tool db2licm (CVE-2018-1710).

Source: CONFIRM
Type: Vendor Advisory
https://www.ibm.com/support/docview.wss?uid=ibm10729981

Source: CCN
Type: IBM Security Bulletin 793907 (Spectrum Protect)
Multiple Db2 vulnerabilities affect the IBM Spectrum Protect Server (CVE-2018-1685, CVE-2018-1710, CVE-2018-1711, CVE-2018-1780, CVE-2018-1781, CVE-2018-1799, CVE-2018-1802, CVE-2018-1834, CVE-2018-1857, CVE-2018-1897)

Vulnerable Configuration:

Configuration 1:

cpe:/a:ibm:db2:10.1:*:*:*:*:-:*:*

OR cpe:/a:ibm:db2:10.5:*:*:*:*:*:*:*

OR cpe:/a:ibm:db2:11.1:*:*:*:*:*:*:*

AND

cpe:/o:linux:linux_kernel:-:*:*:*:*:*:*:*

OR cpe:/o:microsoft:windows:-:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK