|
Problem IC81836
|
Status: Closed |
SECURITY: UNAUTHORIZED ACCESS TO TABLES |
| product: |
DB2 FOR LUW / DB2FORLUW / 980 - DB2 |
| Problem description: |
There is a security vulnerability in DB2 servers which could
allow
an authenticated, malicious user to read data from a table for
which they do not have the authority to view.
To exploit this vulnerability, the user needs to have valid
security credentials, and CONNECT and CREATEIN privileges
to the database. |
| Problem Summary: |
****************************************************************
* USERS AFFECTED: *
* All DB2 systems on all Linux, Unix and Windows platforms at *
* service levels Version 9.8 GA through to Version 9.8 Fix *
* Pack 4. *
****************************************************************
* PROBLEM DESCRIPTION: *
* See Error Description *
****************************************************************
* RECOMMENDATION: *
* Upgrade to DB2 Version 9.8 Fix Pack 5 or see "Local Fix" *
* portion for other suggestions. *
**************************************************************** |
| Local Fix: |
This vulnerability can be mitigated by revoking the CONNECT and
CREATEIN privileges from PUBLIC. You can revoke the CONNECT and
CREATEIN privileges from PUBLIC by issuing the following
statements: revoke
REVOKE CONNECT ON DATABASE FROM PUBLIC
REVOKE IMPLICIT_SCHEMA ON DATABASE FROM PUBLIC |
| Solution |
The complete fix for this problem first appears in DB2 Version
9.8 Fix Pack 5 and all the subsequent Fix Packs. |
| Workaround |
not known / see Local fix |
| Timestamps |
Date - problem reported :
Date - problem closed :
Date - last modified :
| 06.03.2012
31.05.2012
31.05.2012 |
| Problem solved at the following versions (IBM BugInfos) |
9.8.FP5
|
| Problem solved according to the fixlist(s) of the following version(s) |
