Description
Multiple untrusted search path vulnerabilities in unspecified (1) setuid and (2) setgid programs in IBM DB2 9.5, 9.7 before FP9a, 9.8, 10.1 before FP3a, and 10.5 before FP3a on Linux and UNIX allow local users to gain root privileges via a Trojan horse library.
References
- 20140603 CVE-2014-0907 - SetUID/SetGID Programs Allow Privilege Escalation Via Insecure RPATH In IBM DB2 mailing-list
- http://www-304.ibm.com/support/docview.wss?uid=swg21676135
- IT00686 vendor-advisory
- http://www.ibm.com/support/docview.wss?uid=swg1IT00686
- http://www.ibm.com/support/docview.wss?uid=swg21672100
- http://www-01.ibm.com/support/docview.wss?uid=isg400001843
- 59463 third-party-advisory
- http://www-01.ibm.com/support/docview.wss?uid=isg400001841
- http://www.ibm.com/support/docview.wss?uid=swg21610582#4
- 1030670 vdb-entry
- 67617 vdb-entry
- IT00685 vendor-advisory
- https://www.portcullis-security.com/security-research-and-downloads/security-advisories/cve-2014-0907/
- http://www-01.ibm.com/support/docview.wss?uid=swg21680454
- 1030671 vdb-entry
- ibm-cve20140907-priv-escalation(91869) vdb-entry
- 60482 third-party-advisory
- 59451 third-party-advisory
- IT00687 vendor-advisory
- http://packetstormsecurity.com/files/126940/IBM-DB2-Privilege-Escalation.html
- IT00684 vendor-advisory
- IT00627 vendor-advisory