DB2 FOR LUW / DB2FORLUW / 970 - DB2

DB2 server contain a security vulnerability which could allow an 
authenticated user to temporarily gain SELECT, INSERT, UPDATE or 
DELETE privileges on a table. To exploit the vulnerability, the 
user would need to have a valid security credential to connect 
to the database and EXPLAIN, SQLADM or DBADM authority. 
 
Under unspecified conditions, a user with the above authorities 
will be able to execute a DML statement such as SELECT, INSERT, 
UPDATE and DELETE on a table that they do not have authority 
for. Only DML statements are vulnerable. 
 
The following query will show which user has EXPLAIN / SQLADM / 
DBADM authority but no DATAACCESS authority: 
 
select substr(grantor,1,10) grantor , substr(grantee,1,20) 
grantee , granteetype, explainauth, dbadmauth, sqladmauth, 
dataaccessauth from SYSCAT.DBAUTH where dataaccessauth = 'N' and 
(explainauth = 'Y' or dbadmauth = 'Y' or sqladmauth = 'Y') 
 
GRANTOR GRANTEE GRANTEETYPE EXPLAINAUTH DBADMAUTH SQLADMAUTH 
DATAACCESSAUTH 
---------- -------------------- ----------- ----------- 
--------- ---------- -------------- 
MYSECADM BOB U Y N N N 
MYSECADM ROLE_DBADM R N Y N N 
MYSECADM ROLE_SQLADM R N N Y N 
MYSECADM ROLE_EXPLAIN R Y N N N 
MYSECADM ALEX U N Y N N 
MYSECADM JOHN U N N Y N

**************************************************************** 
* USERS AFFECTED:                                              * 
* All DB2 systems on all Linux, Unix and Windows platforms at  * 
* service levels Version 9.7 GA  through to Version 9.7 Fix    * 
* Pack 8.                                                      * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* See Error Description                                        * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Upgrade to DB2 Version 9.7 Fix Pack 9.                       * 
****************************************************************

DB2 Version 9.7 Fix Pack 9 for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 9a for Linux, UNIX, and Windows
 DB2 Version 9.7 Fix Pack 10 for Linux, UNIX, and Windows
 

The complete fix for this problem first appears in DB2 Version 
9.7 Fix Pack 9 and all the subsequent Fix Packs. 
 
Security Bulletin: Unauthorized Access to Table Vulnerability in 
DB2 (CVE-2013-4033) 
http://www-01.ibm.com/support/docview.wss?uid=swg21646809

not known / see Local fix

forerunner  : APAR is sysrouted TO one or more of the following: IC94756 IC94757 IC94758 
follow-up : 

Date  - problem reported    :
Date  - problem closed      :
Date  - last modified       :

31.07.2013
16.12.2013
16.12.2013

9.7.FP9