The Vigil@nce team watches public vulnerabilities impacting your computers, and then offers security solutions, a database and tools to fix them.

vulnerability bulletin CVE-2012-2194 CVE-2012-2196 CVE-2012-2197

IBM DB2 9.7: five vulnerabilities

Synthesis of the vulnerability

An attacker can use five vulnerabilities of IBM DB2, in order to create a denial of service or to elevate his privileges.
Impacted products: DB2 UDB.
Severity: 2/4.
Creation date: 18/10/2012.
Identifiers: BID-56133, CVE-2012-2194, CVE-2012-2196, CVE-2012-2197, CVE-2012-4826, IC84019, IC84099, IC84555, IC84614, IC84711, IC84712, IC84714, IC84716, IC84748, IC84750, IC84751, IC84752, IC84753, IC84754, IC84755, IC86781, IC86783, swg21412438, swg21450666, swg21607618, swg21607622, swg21607628, swg21614536, VIGILANCE-VUL-12083.

Description of the vulnerability

Several vulnerabilities were announced in IBM DB2.

An attacker can create a Cross Site Scripting in the Information Center. [severity:2/4; IC84099]

An attacker can use GET_WRAP_CFG_C and GET_WRAP_CFG_C2 to access to XML files (VIGILANCE-VUL-11845). [severity:2/4; CVE-2012-2196, IC84614, IC84712, IC84748, IC84750, IC84751, swg21607618]

An authenticated attacker can generate a buffer overflow in the processing of Java stored procedures, in order to elevate his privileges (VIGILANCE-VUL-11871). [severity:2/4; CVE-2012-2197, IC84555, IC84752, IC84753, IC84754, IC84755, swg21607628]

An authenticated attacker can use SQLJ.DB2_INSTALL_JAR to replace a JAR archive, in order to execute privileged code (VIGILANCE-VUL-11870). [severity:2/4; CVE-2012-2194, IC84019, IC84711, IC84714, IC84716, swg21607622]

An attacker can use a persistent query, in order to create a buffer overflow. [severity:2/4; BID-56133, CVE-2012-4826, IC86781, IC86783, swg21614536]
Complete Vigil@nce bulletin.... (Free trial)

Computer vulnerabilities tracking service

Vigil@nce provides systems vulnerabilities alerts. The technology watch team tracks security threats targeting the computer system. The Vigil@nce security watch publishes vulnerability bulletins about threats impacting the information system. The Vigil@nce team tracks computer vulnerabilities impacting systems and applications.