|The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.|
vulnerability bulletin CVE-2012-2194 CVE-2012-2196 CVE-2012-2197
IBM DB2 9.7: five vulnerabilities
Synthesis of the vulnerability
An attacker can use five vulnerabilities of IBM DB2, in order to create a denial of service or to elevate his privileges.
Impacted products: DB2 UDB.
Creation date: 18/10/2012.
Identifiers: BID-56133, CVE-2012-2194, CVE-2012-2196, CVE-2012-2197, CVE-2012-4826, IC84019, IC84099, IC84555, IC84614, IC84711, IC84712, IC84714, IC84716, IC84748, IC84750, IC84751, IC84752, IC84753, IC84754, IC84755, IC86781, IC86783, swg21412438, swg21450666, swg21607618, swg21607622, swg21607628, swg21614536, VIGILANCE-VUL-12083.
Description of the vulnerability
Several vulnerabilities were announced in IBM DB2.
An attacker can create a Cross Site Scripting in the Information Center. [severity:2/4; IC84099]
An attacker can use GET_WRAP_CFG_C and GET_WRAP_CFG_C2 to access to XML files (VIGILANCE-VUL-11845). [severity:2/4; CVE-2012-2196, IC84614, IC84712, IC84748, IC84750, IC84751, swg21607618]
An authenticated attacker can generate a buffer overflow in the processing of Java stored procedures, in order to elevate his privileges (VIGILANCE-VUL-11871). [severity:2/4; CVE-2012-2197, IC84555, IC84752, IC84753, IC84754, IC84755, swg21607628]
An authenticated attacker can use SQLJ.DB2_INSTALL_JAR to replace a JAR archive, in order to execute privileged code (VIGILANCE-VUL-11870). [severity:2/4; CVE-2012-2194, IC84019, IC84711, IC84714, IC84716, swg21607622]
An attacker can use a persistent query, in order to create a buffer overflow. [severity:2/4; BID-56133, CVE-2012-4826, IC86781, IC86783, swg21614536]
Complete Vigil@nce bulletin.... (free trial)
Computer vulnerabilities tracking service
Vigil@nce provides systems vulnerabilities alerts. The technology watch team tracks security threats targeting the computer system. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.