CVE-2019-4447

IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum_debug is a setuid root binary which trusts the PATH environment variable. A low privileged user can execute arbitrary commands as root by altering the PATH variable to point to a user controlled location. When a crash is induced the trojan gdb command is executed. IBM X-Force ID: 163488.

CVSS v3 7.8 HIGH
CVSS v2.0 7.2 HIGH

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2^/10

CVSS v2.0 : HIGH

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://www.ibm.com/support/docview.wss?uid=ibm10964592	Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/163488	VDB Entry Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.1:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.1:if1::::::
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.1:if2::::::
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.2:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.2:if1::::::

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*

History

No history.

Information

Published : 2019-08-26 15:15

Updated : 2023-12-10 12:59

NVD link : CVE-2019-4447

Mitre link : CVE-2019-4447

CVE.ORG link : CVE-2019-4447

JSON object : View

Products Affected

microsoft

windows

linux

linux_kernel

ibm

db2_high_performance_unload_load

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2019-4447", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 7.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 3.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 8.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 2.5}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-08-26T15:15:13.047", "references": [{"url": "http://www.ibm.com/support/docview.wss?uid=ibm10964592", "tags": ["Patch", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/163488", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "IBM DB2 High Performance Unload load for LUW 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2 db2hpum_debug is a setuid root binary which trusts the PATH environment variable. A low privileged user can execute arbitrary commands as root by altering the PATH variable to point to a user controlled location. When a crash is induced the trojan gdb command is executed. IBM X-Force ID: 163488."}, {"lang": "es", "value": "IBM DB2 High Performance Unload carga para LUW versiones 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1 y 6.1.0.1 IF2, el archivo db2hpum_debug, que es un binario root de setuid que conf\u00eda en la variable de entorno PATH. Un usuario poco privilegiado puede ejecutar comandos arbitrarios como root mediante la modificaci\u00f3n de la variable PATH para que apunte hacia una ubicaci\u00f3n controlada por el usuario. Cuando un bloqueo es inducido, es ejecutado el comando troyano gdb. ID de IBM X-Force: 163488."}], "lastModified": "2022-12-02T22:25:25.437", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5BB5FA93-50A8-4C74-A97D-F078F1CF0012"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD06C56E-13E7-40B8-8912-BE5162365FD8"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.1:if1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "4D0C15E6-BCEA-4048-92F2-BB44490188B1"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.1:if2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "557AEB73-AD0C-4CF9-B702-31E2CC527035"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7938A98-4039-46F0-BAA0-DD413B9F884A"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.2:if1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BFBC3172-A6B8-4D26-9A6E-F16F9978B2A9"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}