DB2 FOR LUW / DB2FORLUW / 910 - DB2

Users are able to incorrectly update statistics columns 
in SYSSTAT.TABLES for tables upon which they do not have 
appropriate privileges.  Thus, a malicious user may be able to 
introduce query performance degradations by modifying table 
statistics via this view. 
 
Normally, in order to update the statistics for a 
table via this view, you must have CONTROL or explicit 
DATAACCESS privilege on the table.    This APAR fix addresses 
this problem.

**************************************************************** 
* USERS AFFECTED:                                              * 
* All users running on Linux, Unix and Windows servers on DB2  * 
* v9.1 Fix Pack 9 and earlier are affected.                    * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* The view text of SYSSTAT.TABLES is suppose to limit the rows * 
* returned according to the user privileges, but the view is   * 
* returning more rows than it should be. Thus, allowing users  * 
* to modify the statistics for tables they don't have the      * 
* necessary privileges on.                                     * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Refer to Local Fix or update to DB2 v9.1 Fix Pack 10.        * 
****************************************************************

Revoke UPDATE privilege from PUBLIC on the SYSSTAT.TABLES view 
until this APAR is applied. Namely, run: 
 
revoke update on sysstat.tables from public 
 
You may continue updating statistics with appropriate privileges 
via the SYSCAT.TABLES view if needed, which is not affected by 
this problem.

DB2 Version 9.1 Fix Pack 11  for Linux, UNIX and Windows
 DB2 Version 9.1 Fix Pack 12  for Linux, UNIX and Windows
 

The problem is first fixed in DB2 v9.1 Fix Pack 10.

keiner bekannt / siehe Local-Fix

Datum - Problem gemeldet    :
Datum - Problem geschlossen :
Datum - der letzten Änderung:

21.10.2010
05.07.2011
05.07.2011

9.1.FP10