CVE-2010-3197

IBM DB2 9.7 before FP2 does not perform the expected access control on the monitor administrative views in the SYSIBMADM schema, which allows remote attackers to obtain sensitive information via unspecified vectors.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www-01.ibm.com/support/docview.wss?uid=swg1IC67819	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21432298	Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14430
http://www-01.ibm.com/support/docview.wss?uid=swg1IC67819	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21432298	Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14430

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:db2:9.7:::::::*
	cpe:2.3:a:ibm:db2:9.7:fp1::::::

History

21 Nov 2024, 01:18

Type	Values Removed	Values Added
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg1IC67819 - Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?uid=swg1IC67819 - Vendor Advisory
References	~~() http://www-01.ibm.com/support/docview.wss?uid=swg21432298 - Vendor Advisory~~	() http://www-01.ibm.com/support/docview.wss?uid=swg21432298 - Vendor Advisory
References	~~() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14430 -~~	() https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14430 -

Information

Published : 2010-08-31 22:00

Updated : 2024-11-21 01:18

NVD link : CVE-2010-3197

Mitre link : CVE-2010-3197

CVE.ORG link : CVE-2010-3197

JSON object : View

Products Affected

ibm

db2

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2010-3197", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2010-08-31T22:00:02.750", "references": [{"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC67819", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21432298", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14430", "source": "cve@mitre.org"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC67819", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21432298", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14430", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "IBM DB2 9.7 before FP2 does not perform the expected access control on the monitor administrative views in the SYSIBMADM schema, which allows remote attackers to obtain sensitive information via unspecified vectors."}, {"lang": "es", "value": "IBM DB2 v9.7 anterior a FP2 no realiza correctamente el control de acceso en el monitor de vistas administrativas en el esquema SYSIBMADM, lo que permite a atacantes remotos obtener informaci\u00f3n sensible a trav\u00e9s de vectores sin especificar."}], "lastModified": "2024-11-21T01:18:15.420", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2:9.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1C4DE6-EB32-4A31-9FAA-D8DA31D8CF05"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7:fp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "00A16349-5CF1-4E75-A6EE-218E85049F62"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}