|
Problem IC90397
|
Status: Closed |
SECURITY: MULTIPLE GSKIT VULNERABILITIES IN IBM DB2 (CVE-2012-2190, CVE-2012-2191, CVE-2012-2203, CVE-2013-0169). |
| product: |
DB2 FOR LUW / DB2FORLUW / A10 - DB2 |
| Problem description: |
GSKit is an IBM product that is used by DB2 for SSL support.
The GSKit that is shipped with DB2 contains multiple security
vulnerabilities. By default, DB2 does not use SSL for
client-server communication and therefore, DB2 not vulnerable
if SSL is not enabled.
CVE ID: CVE-2012-2190 and CVE-2012-2191
Description:
By sending specially-crafted Secure Sockets Layer (SSL) packets
to the vulnerable DB2 server, a remote attacker could cause the
DB2 server to trap.
CVE ID: CVE-2012-2203
Description:
A vulnerability in GSKit allows an attacker to insertion an
arbitrary root Certification Authority certificate into its key
store.
CVE ID: CVE-2013-0169
Description:
The Transport Layer Security protocol does not properly consider
timing side-channel attacks, which allows remote attackers to
conduct distinguishing attacks and plain-text recovery attacks
via statistical analysis of timing data for crafted packets, aka
the "Lucky Thirteen" issue.
The attack does not require local network access nor does it
require authentication, but some degree of specialized knowledge
and techniques are required. An exploit may impact the
confidentiality of information but the integrity of data, or the
availability of the system would not be compromised. |
| Problem Summary: |
****************************************************************
* USERS AFFECTED: *
* All DB2 systems on all Linux, Unix and Windows platforms at *
* service levels Version 10.1 GA through to Version 10.1 Fix *
* Pack 3. *
****************************************************************
* PROBLEM DESCRIPTION: *
* See Error Description *
****************************************************************
* RECOMMENDATION: *
* Upgrade to DB2 Version 10.1 Fix Pack XX. *
**************************************************************** |
| Local Fix: |
|
| available fix packs: |
DB2 Version 10.1 Fix Pack 4 for Linux, UNIX, and Windows
DB2 Version 10.1 Fix Pack 6 for Linux, UNIX, and Windows
|
| Solution |
See Security Bulletin: Multiple GSKit Vulnerabilities in IBM DB2
(CVE-2012-2190, CVE-2012-2191, CVE-2012-2203).
http://www-01.ibm.com/support/docview.wss?uid=swg21626749
See Security Bulletin: IBM DB2 is impacted by a vulnerability in
the IBM GSKit library (CVE-2013-0169).
http://www-01.ibm.com/support/docview.wss?uid=swg21639354 |
| Workaround |
not known / see Local fix |
| Timestamps |
Date - problem reported :
Date - problem closed :
Date - last modified :
| 21.02.2013
02.06.2014
02.06.2014 |
| Problem solved at the following versions (IBM BugInfos) |
|
| Problem solved according to the fixlist(s) of the following version(s) |
| 10.1.0.4
|
 |
