DB2 FOR LUW / DB2FORLUW / 970 - DB2

Users are able to incorrectly update statistics columns 
in SYSSTAT.TABLES for tables upon which they do not have 
appropriate privileges.  Thus, a malicious user may be able to 
introduce query performance degradations by modifying table 
statistics via this view. 
 
Normally, in order to update the statistics for a 
table via this view, you must have CONTROL or explicit 
DATAACCESS privilege on the table.    This APAR fix addresses 
this problem.

**************************************************************** 
* USERS AFFECTED:                                              * 
* DB2 Version 9.7 GA through to Fix Pack 3 servers on Linux,   * 
* Unix and Windows platforms, updating                         * 
* the SYSSTAT.TABLES view.                                     * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* The view definition doesn't check for the correct user       * 
* authorization.                                               * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Apply DB2 Version 9.7 Fix Pack 4 and run db2updv97 to update * 
* the view definition text. Otherwise, please refer to the     * 
* Local Fix.                                                   * 
****************************************************************

Revoke UPDATE privilege from PUBLIC on the SYSSTAT.TABLES view 
until this APAR is applied. Namely, run: 
 
revoke update on sysstat.tables from public 
 
You may continue updating statistics with appropriate privileges 
via the SYSCAT.TABLES view if needed, which is not affected by 
this problem.

DB2 Version 9.7 Fix Pack 4 for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 5 for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 6 for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 7 for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 8 for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 9 for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 10 for Linux, UNIX, and Windows
 

Problem is first fixed in DB2 Version 9.7 Fix Pack 4 and all 
subsequent Fix Packs.

not known / see Local fix

forerunner  : APAR is sysrouted TO one or more of the following: IC72571 
follow-up : 

Date  - problem reported    :
Date  - problem closed      :
Date  - last modified       :

21.10.2010
28.04.2011
28.04.2011

9.7.FP4