Description
The Base Service Utilities component in IBM DB2 9.1 before Fixpak 5 retains a cleartext password in memory after the database connection that sent the password is fully established, which might allow local users to obtain sensitive information by reading a memory dump.
References
- http://www-1.ibm.com/support/docview.wss?uid=swg21255607
- ibm-db2-baseservices-info-disclosure(45139) vdb-entry
- JR27422 vendor-advisory
- ADV-2008-1769 vdb-entry
- 29601 vdb-entry