Latest versionsfixlist
11.1.0.7 FixList
10.5.0.9 FixList
10.1.0.6 FixList
9.8.0.5 FixList
9.7.0.11 FixList
9.5.0.10 FixList
9.1.0.12 FixList
Have problems? - contact us.
Register for free anmeldung-x26
Contact form kontakt-x26

DB2 - Problem description

Problem IC84614 Status: Closed

SECURITY: GET_WRAP_CFG_C AND GET_WRAP_CFG_C2 ALLOWS UNAUTHORIZED ACCESS XML
FILES (CVE-2012-2196).

product:
DB2 FOR LUW / DB2FORLUW / 910 - DB2
Problem description:
The stored procedure GET_WRAP_CFG_C and GET_WRAP_CFG_C2 could be 
exploited to read any XML file 
owned by the DB2 fenced ID.  On Windows, the DB2 fenced ID is an 
administrator.
Problem Summary:
**************************************************************** 
* USERS AFFECTED:                                              * 
* All DB2 systems on all Linux, Unix and Windows platforms at  * 
* service levels from Version 9.1 GA through to Version 9.1    * 
* Fix Pack 11.                                                 * 
**************************************************************** 
* PROBLEM DESCRIPTION:                                         * 
* See Security Bulletin: XML File Disclosure Vulnerability in  * 
* IBM DB2 GET_WRAP_CFG_C and GET_WRAP_CFG_C2 (CVE-2012-2196):  * 
* http://www-01.ibm.com/support/docview.wss?uid=swg21607618    * 
**************************************************************** 
* RECOMMENDATION:                                              * 
* Upgrade to DB2 Version 9.1 Fix Pack 12 or see "Local Fix"    * 
* portion for other suggestions.                               * 
****************************************************************
Local Fix:
The two stored procedures are used by Control Center.  If 
Control Center is not being used then revoke EXECUTE privilege 
on the stored procedures from PUBLIC: 
 
REVOKE EXECUTE ON PROCEDURE SYSPROC.GET_WRAP_CFG_C FROM PUBLIC 
RESTRICT 
REVOKE EXECUTE ON PROCEDURE SYSPROC.GET_WRAP_CFG_C2 FROM PUBLIC 
RESTRICT
Solution
The complete fix for this problem first appears in DB2 Version 
9.1 Fix Pack 12 and all the subsequent Fix Packs.
Workaround
not known / see Local fix
BUG-Tracking
forerunner  : APAR is sysrouted TO one or more of the following: IC84712 IC84748 IC84750 IC84751 
follow-up : 
Timestamps
Date  - problem reported    :
Date  - problem closed      :
Date  - last modified       :
14.06.2012
17.07.2012
21.08.2012
Problem solved at the following versions (IBM BugInfos)
9.1.FP12
Problem solved according to the fixlist(s) of the following version(s)
9.1.0.12 FixList
This site uses cookies to make it easier for us to provide you with our services. By using our site you agree to the use of cookies.