home clear 64x64
en blue 200x116 de orange 200x116 info letter User
suche 36x36
Neueste VersionenFixList
11.1.0.7 FixList
10.5.0.9 FixList
10.1.0.6 FixList
9.8.0.5 FixList
9.7.0.11 FixList
9.5.0.10 FixList
9.1.0.12 FixList
Haben Sie Probleme? - Kontaktieren Sie uns.
Kostenlos registrieren anmeldung-x26
Kontaktformular kontakt-x26

DB2 - Problembeschreibung

Problem IC90397 Status: Geschlossen

SECURITY: MULTIPLE GSKIT VULNERABILITIES IN IBM DB2 (CVE-2012-2190,
CVE-2012-2191, CVE-2012-2203, CVE-2013-0169).

Produkt:
DB2 FOR LUW / DB2FORLUW / A10 - DB2
Problembeschreibung:
GSKit is an IBM product that is used by DB2 for SSL support. 
The GSKit that  is shipped with DB2 contains multiple security 
vulnerabilities.  By default, DB2 does not use SSL for 
client-server communication and therefore, DB2 not vulnerable 
if SSL is not enabled. 
 
CVE ID:  CVE-2012-2190 and CVE-2012-2191 
 
Description: 
 
By sending specially-crafted Secure Sockets Layer (SSL) packets 
to the vulnerable DB2 server, a remote attacker could cause the 
DB2 server to trap. 
 
 
CVE ID:  CVE-2012-2203 
 
Description: 
 
A vulnerability in GSKit allows an attacker to insertion an 
arbitrary root Certification Authority certificate into its key 
store. 
 
CVE ID: CVE-2013-0169 
 
Description: 
 
The Transport Layer Security protocol does not properly consider 
timing side-channel attacks, which allows remote attackers to 
conduct distinguishing attacks and plain-text recovery attacks 
via statistical analysis of timing data for crafted packets, aka 
the "Lucky Thirteen" issue. 
 
The attack does not require local network access nor does it 
require authentication, but some degree of specialized knowledge 
and techniques are required. An exploit may impact the 
confidentiality of information but the integrity of data, or the 
availability of the system would not be compromised.
Problem-Zusammenfassung:
**************************************************************** 
* USERS AFFECTED:                                              * 
* All DB2 systems on all Linux, Unix and Windows platforms at  * 
* service levels Version 10.1 GA  through to Version 10.1 Fix  * 
* Pack 3.                                                      * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* See Error Description                                        * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Upgrade to DB2 Version 10.1 Fix Pack XX.                     * 
****************************************************************
Local-Fix:
verfügbare FixPacks:
DB2 Version 10.1 Fix Pack 4 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 6 for Linux, UNIX, and Windows

Lösung
See Security Bulletin: Multiple GSKit Vulnerabilities in IBM DB2 
(CVE-2012-2190, CVE-2012-2191, CVE-2012-2203). 
http://www-01.ibm.com/support/docview.wss?uid=swg21626749 
 
See Security Bulletin: IBM DB2 is impacted by a vulnerability in 
the IBM GSKit library (CVE-2013-0169). 
http://www-01.ibm.com/support/docview.wss?uid=swg21639354
Workaround
keiner bekannt / siehe Local-Fix
Weitere Daten
Datum - Problem gemeldet    :
Datum - Problem geschlossen :
Datum - der letzten Änderung:
21.02.2013
02.06.2014
02.06.2014
Problem behoben ab folgender Versionen (IBM BugInfos)
Problem behoben lt. FixList in der Version
10.1.0.4 FixList