DB2 - Problembeschreibung
Problem IC81379 | Status: Geschlossen |
SECURITY: DENIAL OF SERVICE SECURITY VULNERABILITY IN DB2'S XML FEATURE (CVE-2012-0712). | |
Produkt: | |
DB2 FOR LUW / DB2FORLUW / 950 - DB2 | |
Problembeschreibung: | |
There is a security vulnerability in the DB2's XML Feature which would allow an authenticated, malicious user to remotely cause a denial of service. To exploit the vulnerability, the user would need to have valid security credentials, and CONNECT privilege to the database. | |
Problem-Zusammenfassung: | |
**************************************************************** * USERS AFFECTED: * * All DB2 systems on all Linux, Unix and Windows platforms at * * service levels from Version 9.5 GA through to Version 9.5 * * Fix Pack 8. * **************************************************************** * PROBLEM DESCRIPTION: * * See Error Description. * **************************************************************** * RECOMMENDATION: * * Upgrade to DB2 Version 9.5 Fix Pack 9 or see "Local Fix" * * portion for other suggestions. * **************************************************************** | |
Local-Fix: | |
The vulnerability could be mitigated by revoking CONNECT privilege from public: REVOKE CONNECT ON DATABASE FROM PUBLIC | |
verfügbare FixPacks: | |
DB2 Version 9.5 Fix Pack 9 for Linux, UNIX, and Windows | |
Lösung | |
The complete fix for this problem first appears in DB2 Version 9.5 Fix Pack 9 and all the subsequent Fix Packs. | |
Workaround | |
keiner bekannt / siehe Local-Fix | |
Weitere Daten | |
Datum - Problem gemeldet : Datum - Problem geschlossen : Datum - der letzten Änderung: | 13.02.2012 06.03.2012 06.07.2012 |
Problem behoben ab folgender Versionen (IBM BugInfos) | |
9.5.FP9 | |
Problem behoben lt. FixList in der Version | |
9.5.0.9 |