CVE-2019-4606

IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search path vulnerability. By using a executable file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 168298.

CVSS v3 7.8 HIGH
CVSS v2.0 6.9 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.9^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:M/Au:N/C:C/I:C/A:C

Exploitability : 3.4 / Impact : 10.0

Access Vector LOCAL

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://exchange.xforce.ibmcloud.com/vulnerabilities/168298	VDB Entry Vendor Advisory
https://www.ibm.com/support/pages/node/1128063	Vendor Advisory

Configurations

Configuration 1 (hide)

AND

OR	cpe:2.3:a:ibm:db2_high_performance_unload_load:5.1.0.0:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:5.1.0.1:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.0:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.1:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.2:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.3:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.5.0.0:::::::*
	cpe:2.3:a:ibm:db2_high_performance_unload_load:6.5.0.0:if1::::::

OR	cpe:2.3:o:linux:linux_kernel:-:::::::*
	cpe:2.3:o:microsoft:windows:-:::::::*
	cpe:2.3:o:opengroup:unix:-:::::::*

History

No history.

Information

Published : 2019-12-12 17:15

Updated : 2023-12-10 13:13

NVD link : CVE-2019-4606

Mitre link : CVE-2019-4606

CVE.ORG link : CVE-2019-4606

JSON object : View

Products Affected

ibm

db2_high_performance_unload_load

microsoft

windows

opengroup

unix

linux

linux_kernel

CWE

CWE-426

Untrusted Search Path

{"id": "CVE-2019-4606", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.9, "accessVector": "LOCAL", "vectorString": "AV:L/AC:M/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 3.4, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Secondary", "source": "psirt@us.ibm.com", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 7.4, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.0/AV:L/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "HIGH", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.4}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2019-12-12T17:15:10.960", "references": [{"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/168298", "tags": ["VDB Entry", "Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "https://www.ibm.com/support/pages/node/1128063", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-426"}]}], "descriptions": [{"lang": "en", "value": "IBM DB2 High Performance Unload load for LUW 6.1 and 6.5 could allow a local attacker to execute arbitrary code on the system, caused by an untrusted search path vulnerability. By using a executable file, an attacker could exploit this vulnerability to execute arbitrary code on the system. IBM X-Force ID: 168298."}, {"lang": "es", "value": "La carga de IBM DB2 High Performance Unload para LUW versiones 6.1 y 6.5, podr\u00eda permitir a un atacante local ejecutar c\u00f3digo arbitrario en el sistema, causado por una vulnerabilidad de ruta de b\u00fasqueda no confiable. Mediante el uso de un archivo ejecutable, un atacante podr\u00eda explotar esta vulnerabilidad para ejecutar c\u00f3digo arbitrario en el sistema. ID de IBM X-Force: 168298."}], "lastModified": "2019-12-16T18:39:01.310", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:5.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E2E0B4C6-7A35-43F2-86FC-23B12FBE0D55"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:5.1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6ABCDC01-1FF1-4596-A1FC-15B54C1FC1DD"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "5F3710A2-9D52-49C0-B745-BCADEABAD28F"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "BD06C56E-13E7-40B8-8912-BE5162365FD8"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D7938A98-4039-46F0-BAA0-DD413B9F884A"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.1.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D3B3EE23-0356-4490-8C89-8619AE596FC5"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.5.0.0:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D6ACF327-FF08-49B3-8902-7759258B18C6"}, {"criteria": "cpe:2.3:a:ibm:db2_high_performance_unload_load:6.5.0.0:if1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2BEF8EB1-FB2A-4CD4-BA6B-6DFD18441227"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:linux:linux_kernel:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "703AF700-7A70-47E2-BC3A-7FD03B3CA9C1"}, {"criteria": "cpe:2.3:o:microsoft:windows:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "A2572D17-1DE6-457B-99CC-64AFD54487EA"}, {"criteria": "cpe:2.3:o:opengroup:unix:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6A90CB3A-9BE7-475C-9E75-6ECAD2106302"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "psirt@us.ibm.com"}