|
Problem IC70406
|
Status: Closed |
SECURITY: UPDATE AGAINST A TABLE VIA A COMPOUND SQL (COMPILED) STATEMENT MAY BE EXECUTED BY USER WTHOUT REQUIRED PRIVILEGES |
| product: |
DB2 FOR LUW / DB2FORLUW / 970 - DB2 |
| Problem description: |
If a compound SQL (compiled) statement has been issued by a user
that is properly authorized, this is cached in the dynamic SQL
cache. Once cached, this same query can be executed by any
user if that user has the proper authority.
In this case, there is a bug when the compound SQL (compiled)
statement includes an update statement against a table. In
this case once the statement has been compiled (via a prepare or
execute immediate request) by a user with the required update
privilege on the table, then a user that does not have update
privilege on the table issuing the same statement might be able
to resolve to the cached entry and successfully execute the
query.
The problem only applies to update privileges, compound SQL
(compiled) statements and statements that have already been
cached. |
| Problem Summary: |
****************************************************************
* USERS AFFECTED: *
* compound SQL (compiled) statements with table updates *
****************************************************************
* PROBLEM DESCRIPTION: *
* unauthorized user able to issue cached compound SQL *
* (compiled) statement with update statement *
****************************************************************
* RECOMMENDATION: *
* move to DB2 for LUW version 9, fixpack 3 *
**************************************************************** |
| Local Fix: |
Avoid update statements in compound SQL (compiled) statements |
| available fix packs: |
DB2 Version 9.7 Fix Pack 3 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 3a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 4 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 5 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 6 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 7 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 8 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 9 for Linux, UNIX, and Windows
DB2 Version 9.7 Fix Pack 10 for Linux, UNIX, and Windows
|
| Solution |
Fixed in DB2 for LUW version 9, fixpack 3 |
| Workaround |
not known / see Local fix |
| BUG-Tracking |
forerunner : APAR is sysrouted TO one or more of the following: IC70408
follow-up : |
| Timestamps |
Date - problem reported :
Date - problem closed :
Date - last modified :
| 05.08.2010
14.09.2010
14.09.2010 |
| Problem solved at the following versions (IBM BugInfos) |
9.0.FP3
|
| Problem solved according to the fixlist(s) of the following version(s) |
| 9.7.0.3
|
 |
| 9.7.0.3
|
|
