CVE Vulnerabilities

CVE-2017-1520

Improper Authentication

Published: Sep 12, 2017 | Modified: Sep 15, 2017
CVSS 3.x
3.7
LOW
Source:
NVD
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N
CVSS 2.x
4.3 MEDIUM
AV:N/AC:M/Au:N/C:N/I:P/A:N
RedHat/V2
RedHat/V3
Ubuntu

IBM DB2 9.7, 10,1, 10.5, and 11.1 is vulnerable to an unauthorized command that allows the database to be activated when authentication type is CLIENT. IBM X-Force ID: 129830.

Weakness

When an actor claims to have a given identity, the product does not prove or insufficiently proves that the claim is correct.

Affected Software

Name Vendor Start Version End Version
Db2 Ibm 9.7 (including) 9.7 (including)
Db2 Ibm 9.7.0.1 (including) 9.7.0.1 (including)
Db2 Ibm 9.7.0.2 (including) 9.7.0.2 (including)
Db2 Ibm 9.7.0.3 (including) 9.7.0.3 (including)
Db2 Ibm 9.7.0.4 (including) 9.7.0.4 (including)
Db2 Ibm 9.7.0.5 (including) 9.7.0.5 (including)
Db2 Ibm 9.7.0.6 (including) 9.7.0.6 (including)
Db2 Ibm 9.7.0.7 (including) 9.7.0.7 (including)
Db2 Ibm 9.7.0.8 (including) 9.7.0.8 (including)
Db2 Ibm 9.7.0.9 (including) 9.7.0.9 (including)
Db2 Ibm 9.7.0.9-a (including) 9.7.0.9-a (including)
Db2 Ibm 9.7.0.10 (including) 9.7.0.10 (including)
Db2 Ibm 9.7.0.11 (including) 9.7.0.11 (including)
Db2 Ibm 10.1 (including) 10.1 (including)
Db2 Ibm 10.1.0.1 (including) 10.1.0.1 (including)
Db2 Ibm 10.1.0.2 (including) 10.1.0.2 (including)
Db2 Ibm 10.1.0.3 (including) 10.1.0.3 (including)
Db2 Ibm 10.1.0.4 (including) 10.1.0.4 (including)
Db2 Ibm 10.1.0.5 (including) 10.1.0.5 (including)
Db2 Ibm 10.5 (including) 10.5 (including)
Db2 Ibm 10.5.0.1 (including) 10.5.0.1 (including)
Db2 Ibm 10.5.0.2 (including) 10.5.0.2 (including)
Db2 Ibm 10.5.0.3 (including) 10.5.0.3 (including)
Db2 Ibm 10.5.0.3-a (including) 10.5.0.3-a (including)
Db2 Ibm 10.5.0.4 (including) 10.5.0.4 (including)
Db2 Ibm 10.5.0.5 (including) 10.5.0.5 (including)
Db2 Ibm 10.5.0.6 (including) 10.5.0.6 (including)
Db2 Ibm 10.5.0.7 (including) 10.5.0.7 (including)
Db2 Ibm 11.1.0.0 (including) 11.1.0.0 (including)
Db2_connect Ibm 9.7 (including) 9.7 (including)
Db2_connect Ibm 9.7.0.1 (including) 9.7.0.1 (including)
Db2_connect Ibm 9.7.0.2 (including) 9.7.0.2 (including)
Db2_connect Ibm 9.7.0.3 (including) 9.7.0.3 (including)
Db2_connect Ibm 9.7.0.4 (including) 9.7.0.4 (including)
Db2_connect Ibm 9.7.0.5 (including) 9.7.0.5 (including)
Db2_connect Ibm 9.7.0.6 (including) 9.7.0.6 (including)
Db2_connect Ibm 9.7.0.7 (including) 9.7.0.7 (including)
Db2_connect Ibm 9.7.0.8 (including) 9.7.0.8 (including)
Db2_connect Ibm 9.7.0.9 (including) 9.7.0.9 (including)
Db2_connect Ibm 9.7.0.10 (including) 9.7.0.10 (including)
Db2_connect Ibm 9.7.0.11 (including) 9.7.0.11 (including)
Db2_connect Ibm 10.1 (including) 10.1 (including)
Db2_connect Ibm 10.1.0.1 (including) 10.1.0.1 (including)
Db2_connect Ibm 10.1.0.2 (including) 10.1.0.2 (including)
Db2_connect Ibm 10.1.0.3 (including) 10.1.0.3 (including)
Db2_connect Ibm 10.1.0.4 (including) 10.1.0.4 (including)
Db2_connect Ibm 10.1.0.5 (including) 10.1.0.5 (including)
Db2_connect Ibm 10.5 (including) 10.5 (including)
Db2_connect Ibm 10.5.0.1 (including) 10.5.0.1 (including)
Db2_connect Ibm 10.5.0.2 (including) 10.5.0.2 (including)
Db2_connect Ibm 10.5.0.3 (including) 10.5.0.3 (including)
Db2_connect Ibm 10.5.0.4 (including) 10.5.0.4 (including)
Db2_connect Ibm 10.5.0.5 (including) 10.5.0.5 (including)
Db2_connect Ibm 10.5.0.6 (including) 10.5.0.6 (including)
Db2_connect Ibm 10.5.0.7 (including) 10.5.0.7 (including)
Db2_connect Ibm 11.1.0.0 (including) 11.1.0.0 (including)

Potential Mitigations

References