Vulnerability-Lookup

CNVD-2017-02698

Vulnerability from cnvd - Published: 2017-03-14

Title

多个IBM DB2产品信息泄露漏洞

Description

IBM DB2是美国IBM公司的一套关系型数据库管理系统。基于AIX, Linux, HP, Solaris或Windows平台的IBM DB2 10.1、10.5和11.1版本中存在信息泄露漏洞。攻击者可利用该漏洞获取敏感信息。

Severity

低

Patch Name

多个IBM DB2产品信息泄露漏洞的补丁

Patch Description

IBM DB2是美国IBM公司的一套关系型数据库管理系统。基于AIX, Linux, HP, Solaris或Windows平台的IBM DB2 10.1、10.5和11.1版本中存在信息泄露漏洞。攻击者可利用该漏洞获取敏感信息。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description

厂商已发布了漏洞修复程序，请及时关注更新： http://www.ibm.com/support/docview.wss?uid=swg21999515

Reference

http://securitytracker.com/id/1037946 http://www.securityfocus.com/bid/96597

Impacted products

Name
['IBM DB2 on Windows 10.1', 'IBM DB2 on Solaris 10.1', 'IBM DB2 on Windows 10.5', 'IBM DB2 on HP 10.1', 'IBM DB2 on Solaris 10.5', 'IBM DB2 on Windows 11.1', 'IBM DB2 on HP 10.5', 'IBM DB2 on Solaris 11.1', 'IBM DB2 on HP 11.1', 'IBM DB2 on AIX 10.1', 'IBM DB2 on Linux 10.1', 'IBM DB2 on AIX 10.5', 'IBM DB2 on Linux 10.5', 'IBM DB2 on AIX 11.1', 'IBM DB2 on Linux 11.1']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "96597"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-1150",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-1150"
    }
  },
  "description": "IBM DB2\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u5173\u7cfb\u578b\u6570\u636e\u5e93\u7ba1\u7406\u7cfb\u7edf\u3002\r\n\r\n\u57fa\u4e8eAIX, Linux, HP, Solaris\u6216Windows\u5e73\u53f0\u7684IBM DB2 10.1\u300110.5\u548c11.1\u7248\u672c\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002",
  "discovererName": "IBM",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttp://www.ibm.com/support/docview.wss?uid=swg21999515",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-02698",
  "openTime": "2017-03-14",
  "patchDescription": "IBM DB2\u662f\u7f8e\u56fdIBM\u516c\u53f8\u7684\u4e00\u5957\u5173\u7cfb\u578b\u6570\u636e\u5e93\u7ba1\u7406\u7cfb\u7edf\u3002\r\n\r\n\u57fa\u4e8eAIX, Linux, HP, Solaris\u6216Windows\u5e73\u53f0\u7684IBM DB2 10.1\u300110.5\u548c11.1\u7248\u672c\u4e2d\u5b58\u5728\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u3002\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u83b7\u53d6\u654f\u611f\u4fe1\u606f\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "\u591a\u4e2aIBM DB2\u4ea7\u54c1\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "IBM DB2 on Windows 10.1",
      "IBM DB2 on Solaris 10.1",
      "IBM DB2 on Windows 10.5",
      "IBM DB2 on HP 10.1",
      "IBM DB2 on Solaris 10.5",
      "IBM DB2 on Windows 11.1",
      "IBM DB2 on HP 10.5",
      "IBM DB2 on Solaris 11.1",
      "IBM DB2 on HP 11.1",
      "IBM DB2 on AIX 10.1",
      "IBM DB2 on Linux 10.1",
      "IBM DB2 on AIX 10.5",
      "IBM DB2 on Linux 10.5",
      "IBM DB2 on AIX 11.1",
      "IBM DB2 on Linux 11.1"
    ]
  },
  "referenceLink": "http://securitytracker.com/id/1037946\r\nhttp://www.securityfocus.com/bid/96597",
  "serverity": "\u4f4e",
  "submitTime": "2017-03-03",
  "title": "\u591a\u4e2aIBM DB2\u4ea7\u54c1\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e"
}

CVE-2017-1150 (GCVE-0-2017-1150)

Vulnerability from cvelistv5 – Published: 2017-03-08 19:00 – Updated: 2024-08-05 13:25

Summary

IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables that they should not be permitted to view. IBM Reference #: 1999515.

Severity

No CVSS data available.

CWE

Obtain Information

Assigner

ibm

References

3 references

URL	Tags
http://www.securitytracker.com/id/1037946	vdb-entryx_refsource_SECTRACK
http://www.securityfocus.com/bid/96597	vdb-entryx_refsource_BID
http://www.ibm.com/support/docview.wss?uid=swg21999515	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
IBM Corporation	DB2 for Linux, UNIX and Windows	Affected: 10.5 Affected: 10.1 Affected: 11.1

Date Public

2017-02-28 00:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T13:25:17.274Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "1037946",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1037946"
          },
          {
            "name": "96597",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/96597"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "http://www.ibm.com/support/docview.wss?uid=swg21999515"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "DB2 for Linux, UNIX and Windows",
          "vendor": "IBM Corporation",
          "versions": [
            {
              "status": "affected",
              "version": "10.5"
            },
            {
              "status": "affected",
              "version": "10.1"
            },
            {
              "status": "affected",
              "version": "11.1"
            }
          ]
        }
      ],
      "datePublic": "2017-02-28T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables that they should not be permitted to view. IBM Reference #: 1999515."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Obtain Information",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2017-07-14T09:57:01.000Z",
        "orgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
        "shortName": "ibm"
      },
      "references": [
        {
          "name": "1037946",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1037946"
        },
        {
          "name": "96597",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/96597"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "http://www.ibm.com/support/docview.wss?uid=swg21999515"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@us.ibm.com",
          "ID": "CVE-2017-1150",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "DB2 for Linux, UNIX and Windows",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "10.5"
                          },
                          {
                            "version_value": "10.1"
                          },
                          {
                            "version_value": "11.1"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "IBM Corporation"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "IBM DB2 for Linux, UNIX and Windows (includes DB2 Connect Server) 10.1, 10.5, and 11.1 could allow an authenticated attacker with specialized access to tables that they should not be permitted to view. IBM Reference #: 1999515."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Obtain Information"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "1037946",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1037946"
            },
            {
              "name": "96597",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/96597"
            },
            {
              "name": "http://www.ibm.com/support/docview.wss?uid=swg21999515",
              "refsource": "CONFIRM",
              "url": "http://www.ibm.com/support/docview.wss?uid=swg21999515"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "9a959283-ebb5-44b6-b705-dcc2bbced522",
    "assignerShortName": "ibm",
    "cveId": "CVE-2017-1150",
    "datePublished": "2017-03-08T19:00:00.000Z",
    "dateReserved": "2016-11-30T00:00:00.000Z",
    "dateUpdated": "2024-08-05T13:25:17.274Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

CNVD-2017-02698

CVE-2017-1150 (GCVE-0-2017-1150)

Tags

Sightings

Nomenclature