CVE-2010-3738

The Security component in IBM DB2 UDB 9.5 before FP6a logs AUDIT events by using a USERID and an AUTHID value corresponding to the instance owner, instead of a USERID and an AUTHID value corresponding to the logged-in user account, which makes it easier for remote authenticated users to execute Audit administration commands without discovery.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:N/I:P/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT
http://www-01.ibm.com/support/docview.wss?uid=swg1IC65184	Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14488

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:db2:9.5:::::::*
	cpe:2.3:a:ibm:db2:9.5:fp1::::::
	cpe:2.3:a:ibm:db2:9.5:fp2::::::
	cpe:2.3:a:ibm:db2:9.5:fp2a::::::
	cpe:2.3:a:ibm:db2:9.5:fp3::::::
	cpe:2.3:a:ibm:db2:9.5:fp3a::::::
	cpe:2.3:a:ibm:db2:9.5:fp3b::::::
	cpe:2.3:a:ibm:db2:9.5:fp4::::::
	cpe:2.3:a:ibm:db2:9.5:fp4a::::::
	cpe:2.3:a:ibm:db2:9.5:fp5::::::

History

No history.

Information

Published : 2010-10-05 18:00

Updated : 2023-12-10 11:03

NVD link : CVE-2010-3738

Mitre link : CVE-2010-3738

CVE.ORG link : CVE-2010-3738

JSON object : View

Products Affected

ibm

db2

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2010-3738", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-10-05T18:00:33.440", "references": [{"url": "ftp://public.dhe.ibm.com/ps/products/db2/fixes/english-us/aparlist/db2_v95/APARLIST.TXT", "source": "cve@mitre.org"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC65184", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14488", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "The Security component in IBM DB2 UDB 9.5 before FP6a logs AUDIT events by using a USERID and an AUTHID value corresponding to the instance owner, instead of a USERID and an AUTHID value corresponding to the logged-in user account, which makes it easier for remote authenticated users to execute Audit administration commands without discovery."}, {"lang": "es", "value": "El componente Security en IBM DB2 UDB v9.5 anterior a FP6a registra eventos usando valores USERID y AUTHID correspondientes a la instancia del usuario propietario en vez de usarlos con la instancia de la cuenta de usuario logueado, lo que facilita a usuarios autenticados remotamente la ejecuci\u00f3n de comandos de administraci\u00f3n Audit."}], "lastModified": "2017-09-19T01:31:32.520", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2:9.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11ABF7CC-2FA5-4F2D-901A-2D0EF5B8E717"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:fp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "58147402-53D5-4F15-862B-EE3DCCD75E2C"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:fp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3F3CB5E-D4FB-4C03-B108-06CC358B1F45"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:fp2a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CB2EA14A-878A-4D8D-B17A-568712D21C48"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:fp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "84C925CD-E753-401F-9EC0-6E3D9861C818"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:fp3a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "651D042C-A9F1-42D1-A6DD-95ADBCD08448"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:fp3b:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0A589323-B8B8-4CB4-B1A9-B9E771C99123"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:fp4:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "61252AF9-A231-442A-A473-BA0608323BF2"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:fp4a:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "EB37A1AA-58F0-4A39-8E38-C70692CE67BF"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:fp5:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1D9D5B5B-8E23-4987-9BBE-8FE1F27CB1B5"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}