Description
IBM DB2 9.1 before FP10, 9.5 before FP6a, and 9.7 before FP2 on Linux, UNIX, and Windows does not properly revoke the DBADM authority, which allows remote authenticated users to execute non-DDL statements by leveraging previous possession of this authority.
References
- http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC66815
- IC66814 vendor-advisory
- 43148 third-party-advisory
- IC66815 vendor-advisory
- http://www.ibm.com/support/docview.wss?uid=swg21426108
- http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC66814
- 70773 vdb-entry
- oval:org.mitre.oval:def:14295 vdb-entry signature
- http://www-01.ibm.com/support/docview.wss?crawler=1&uid=swg1IC66811
- ibm-db2-dbadm-priv-esc(65008) vdb-entry
- 46064 vdb-entry
- IC66811 vendor-advisory