Description
IBM DB2 UDB 8 before Fixpak 15 and 9.1 before Fixpak 3 does not properly revoke privileges on methods, which allows remote authenticated users to execute a method after revocation until the routine auth cache is flushed.
References
- http://www-1.ibm.com/support/docview.wss?uid=swg21255607
- 20070818 Recent DB2 Vulnerabilities mailing-list
- ADV-2007-2912 vdb-entry
- IY88158 vendor-advisory
- db2-method-privilege-escalation(36108) vdb-entry
- 25339 vdb-entry
- http://www-1.ibm.com/support/docview.wss?uid=swg21255352
- 26471 third-party-advisory
- IY88226 vendor-advisory