|
Problem IC81390
|
Status: Geschlossen |
SECURITY: UNAUTHORIZED ACCESS TO TABLES |
| Produkt: |
DB2 FOR LUW / DB2FORLUW / 970 - DB2 |
| Problembeschreibung: |
There is a security vulnerability in DB2 servers which could
allow
an authenticated, malicious user to read data from a table for
which they do not have the authority to view.
To exploit this vulnerability, the user needs to have valid
security credentials, and CONNECT and CREATEIN privileges
to the database. |
| Problem-Zusammenfassung: |
****************************************************************
* USERS AFFECTED: *
* All DB2 systems on all Linux, Unix and Windows platforms at *
* service levels Version 9.7 GA through to Version 9.7 Fix *
* Pack 5. *
****************************************************************
* PROBLEM DESCRIPTION: *
* See Error Description *
****************************************************************
* RECOMMENDATION: *
* Upgrade to DB2 Version 9.7 Fix Pack 6 or see "Local Fix" *
* portion for other suggestions. *
**************************************************************** |
| Local-Fix: |
This vulnerability can be mitigated by revoking the CONNECT and
CREATEIN privileges from PUBLIC. You can revoke the CONNECT and
CREATEIN privileges from PUBLIC by issuing the following
statements: revoke
REVOKE CONNECT ON DATABASE FROM PUBLIC
REVOKE IMPLICIT_SCHEMA ON DATABASE FROM PUBLIC |
| verfügbare FixPacks: |
DB2 Version 9.7 Fix Pack 6 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 7 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 8 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 10 for Linux, UNIX, and Windows
|
| Lösung |
The complete fix for this problem first appears in DB2 Version
9.7 Fix Pack 6 and all the subsequent Fix Packs. |
| Workaround |
keiner bekannt / siehe Local-Fix |
| Weitere Daten |
Datum - Problem gemeldet :
Datum - Problem geschlossen :
Datum - der letzten Änderung:
| 13.02.2012
31.05.2012
31.05.2012 |
| Problem behoben ab folgender Versionen (IBM BugInfos) |
9.7.FP6
|
| Problem behoben lt. FixList in der Version |
| 9.7.0.6
|
 |
