Unscored CVE-2005-4871 EUVD-2005-4862GHSA-x59g-h3vc-hf9j

Certain XML functions in IBM DB2 8.1 run with the privileges of DB2 instead of the logged-in user, which allows remote attackers to create …

Published Oct 6, 2007 · Updated Aug 8, 2024 · Assigned by mitre

Description

Certain XML functions in IBM DB2 8.1 run with the privileges of DB2 instead of the logged-in user, which allows remote attackers to create or overwrite files via (1) XMLFileFromVarchar or (2) XMLFileFromClob, or read files via (3) XMLVarcharFromFile or (4) XMLClobFromFile.

References

20050105 IBM DB2 XML functions file creation vulnerabilities (#NISR05012005I) mailing-list
db2-xml-file-creation(18761) vdb-entry
http://www.ngssoftware.com/advisories/db205012005I.txt
12733 third-party-advisory
12170 vdb-entry