Unscored CVE-2008-1998 EUVD-2008-1996GHSA-c95g-rpjx-pm4h

The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authentica…

Published Apr 28, 2008 · Updated Aug 7, 2024 · Assigned by mitre

Description

The NNSTAT (aka SYSPROC.NNSTAT) procedure in IBM DB2 8 before FP16, 9.1 before FP4a, and 9.5 before FP1 on Windows allows remote authenticated users to overwrite arbitrary files via the log file parameter.

References

IZ06976 vendor-advisory
IZ10776 vendor-advisory
IZ06977 vendor-advisory
http://www.appsecinc.com/resources/alerts/db2/2008-03.shtml
3840 third-party-advisory
20080418 Team SHATTER Security Advisory: IBM DB2 UDB Arbitrary file overwrite in SYSPROC.NNSTAT procedure mailing-list
29784 third-party-advisory
28836 vdb-entry
29022 third-party-advisory
ibm-db2-nnstat-file-overwrite(41960) vdb-entry