DB2 FOR LUW / DB2FORLUW / 970 - DB2

GSKit is an IBM product that is used by DB2 for SSL support. 
The GSKit that  is shipped with DB2 contains multiple security 
vulnerabilities.  By default, DB2 does not use SSL for 
client-server communication and therefore, DB2 not vulnerable 
if SSL is not enabled. 
 
CVE ID:  CVE-2012-2190 and CVE-2012-2191 
 
Description: 
 
By sending specially-crafted Secure Sockets Layer (SSL) packets 
to the vulnerable DB2 server, a remote attacker could cause the 
DB2 server to trap. 
 
 
CVE ID:  CVE-2012-2203 
 
Description: 
 
A vulnerability in GSKit allows an attacker to insertion an 
arbitrary root Certification Authority certificate into its key 
store. 
 
CVE ID: CVE-2013-0169 
 
Description: 
 
The Transport Layer Security protocol does not properly consider 
timing side-channel attacks, which allows remote attackers to 
conduct distinguishing attacks and plain-text recovery attacks 
via statistical analysis of timing data for crafted packets, aka 
the "Lucky Thirteen" issue. 
 
The attack does not require local network access nor does it 
require authentication, but some degree of specialized knowledge 
and techniques are required. An exploit may impact the 
confidentiality of information but the integrity of data, or the 
availability of the system would not be compromised.

**************************************************************** 
* USERS AFFECTED:                                              * 
* All DB2 systems on all Linux, Unix and Windows platforms at  * 
* service levels Version 9.7 GA  through to Version 9.7 Fix    * 
* Pack 8                                                       * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* See Error Description                                        * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Upgrade to DB2 Version 9.7 Fix Pack 9.                       * 
****************************************************************

DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 10 for Linux, UNIX, and Windows
 

See Security Bulletin: Multiple GSKit Vulnerabilities in IBM DB2 
(CVE-2012-2190, CVE-2012-2191, CVE-2012-2203). 
http://www-01.ibm.com/support/docview.wss?uid=swg21626749 
 
See Security Bulletin: IBM DB2 is impacted by a vulnerability in 
the IBM GSKit library (CVE-2013-0169). 
http://www-01.ibm.com/support/docview.wss?uid=swg21639354

keiner bekannt / siehe Local-Fix

Datum - Problem gemeldet    :
Datum - Problem geschlossen :
Datum - der letzten Änderung:

21.02.2013
16.12.2013
16.12.2013

9.7.FP9