CVE-2017-1150

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables that they should not be permitted to view. IBM Reference #: 1999515.

CVSS v3 3.1 LOW
CVSS v2.0 3.5 LOW

3.1^/10

CVSS v3 : LOW

Vector : AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N

Exploitability : 1.6 / Impact : 1.4

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

3.5^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:M/Au:S/C:P/I:N/A:N

Exploitability : 6.8 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=swg21999515	Patch Vendor Advisory
http://www.securityfocus.com/bid/96597
http://www.securitytracker.com/id/1037946

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:db2:10.1:::::::*
	cpe:2.3:a:ibm:db2:10.1::::advanced_enterprise:::
	cpe:2.3:a:ibm:db2:10.1::::advanced_workgroup:::
	cpe:2.3:a:ibm:db2:10.1::::enterprise:::
	cpe:2.3:a:ibm:db2:10.1::::express:::
	cpe:2.3:a:ibm:db2:10.1::::workgroup:::
	cpe:2.3:a:ibm:db2:10.5:::::::*
	cpe:2.3:a:ibm:db2:10.5::::advanced_enterprise:::
	cpe:2.3:a:ibm:db2:10.5::::advanced_workgroup:::
	cpe:2.3:a:ibm:db2:10.5::::enterprise:::
	cpe:2.3:a:ibm:db2:10.5::::express:::
	cpe:2.3:a:ibm:db2:10.5::::workgroup:::
	cpe:2.3:a:ibm:db2:11.1:::::::*
	cpe:2.3:a:ibm:db2:11.1::::advanced_enterprise:::
	cpe:2.3:a:ibm:db2:11.1::::advanced_workgroup:::
	cpe:2.3:a:ibm:db2:11.1::::enterprise:::
	cpe:2.3:a:ibm:db2:11.1::::express:::
	cpe:2.3:a:ibm:db2:11.1::::workgroup:::

History

No history.

Information

Published : 2017-03-08 19:59

Updated : 2023-12-10 12:01

NVD link : CVE-2017-1150

Mitre link : CVE-2017-1150

CVE.ORG link : CVE-2017-1150

JSON object : View

Products Affected

ibm

db2

CWE

CWE-269

Improper Privilege Management

{"id": "CVE-2017-1150", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 3.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:P/I:N/A:N", "authentication": "SINGLE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 3.1, "attackVector": "NETWORK", "baseSeverity": "LOW", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "LOW", "confidentialityImpact": "LOW"}, "impactScore": 1.4, "exploitabilityScore": 1.6}]}, "published": "2017-03-08T19:59:00.317", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=swg21999515", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/96597", "source": "psirt@us.ibm.com"}, {"url": "http://www.securitytracker.com/id/1037946", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-269"}]}], "descriptions": [{"lang": "en", "value": "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables that they should not be permitted to view. IBM Reference #: 1999515."}, {"lang": "es", "value": "IBM DB2 para Linux, UNIX y Windows (incluye DB2 Connect Server) 10.1, 10.5 y 11.1 podr\u00eda permitir a un atacante autenticado con acceso especializado a tablas que no se deber\u00eda permitir ver. Referencia IBM #: 1999515."}], "lastModified": "2019-10-03T00:03:26.223", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2:10.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2952EB24-A015-4EC7-85E3-88588D0AB15B"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1:*:*:*:advanced_enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "2ECC11D3-7D77-4823-8B34-DD76E131D74C"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1:*:*:*:advanced_workgroup:*:*:*", "vulnerable": true, "matchCriteriaId": "E1D36687-32AF-43E2-97D9-FDF602F89318"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "DD80ADF4-35D3-4534-AACD-C00D80870723"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1:*:*:*:express:*:*:*", "vulnerable": true, "matchCriteriaId": "8D274B00-C986-4A5D-94B2-79F4A613D951"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1:*:*:*:workgroup:*:*:*", "vulnerable": true, "matchCriteriaId": "67A935CA-7AF6-4DA9-958E-DF4BC8E2B3BF"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6E232F83-BE4C-4B3E-A5B1-53F9D95F0368"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5:*:*:*:advanced_enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "A6B1A4DC-7062-4349-8D1A-3DE4B0E68FC8"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5:*:*:*:advanced_workgroup:*:*:*", "vulnerable": true, "matchCriteriaId": "B3681F43-F23B-413D-B871-A40821F4988B"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "AE645126-ECD0-40FB-B2BA-5C9EF33EBE69"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5:*:*:*:express:*:*:*", "vulnerable": true, "matchCriteriaId": "9AFEA656-426C-4F18-9737-8985531C7A93"}, {"criteria": "cpe:2.3:a:ibm:db2:10.5:*:*:*:workgroup:*:*:*", "vulnerable": true, "matchCriteriaId": "09B0333F-0E27-40B3-A0DC-618BEA97CBC2"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "0DC3F2DB-9AE2-4B11-A838-167E857D831D"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1:*:*:*:advanced_enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "56AA8839-8926-40F1-BB9A-AB648DE7F272"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1:*:*:*:advanced_workgroup:*:*:*", "vulnerable": true, "matchCriteriaId": "6ABE0FCB-8E32-4AB6-A8D8-79159FCDD889"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1:*:*:*:enterprise:*:*:*", "vulnerable": true, "matchCriteriaId": "5D92ADEC-6ED8-4B07-AB75-204AED0BF896"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1:*:*:*:express:*:*:*", "vulnerable": true, "matchCriteriaId": "A2E6CBD8-7DD7-44F7-8F5D-D79074561AB8"}, {"criteria": "cpe:2.3:a:ibm:db2:11.1:*:*:*:workgroup:*:*:*", "vulnerable": true, "matchCriteriaId": "5273074C-9C2F-458C-9333-BD16B59008CA"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}