According to its version, the installation of IBM DB2 10.5 running on the remote host is prior to Fix Pack 8. It is, therefore, affected by the following vulnerabilities :

  - A local privilege escalation vulnerability exists due to     insecurely loading binaries planted in a location that a     SETGID or SETUID binary would execute. A local attacker     can exploit this, via a malicious binary, to gain root     privileges. (CVE-2016-5995)

  - A denial of service vulnerability exists in the     SQLNP_SCOPE_TRIAL() function due to improper handling of     SQL statements. An authenticated, remote attacker can     exploit this to crash the database.

  - A denial of service vulnerability exists in the Query     Compiler QGM due to improper handling of specific     queries. An authenticated, remote attacker can exploit     this, via a specially crafted query, to crash the     database.

バージョン情報によると、リモートホストで実行されているIBM DB2 10.5のインストールはFix Pack 8より前です。したがって、次の脆弱性の影響を受けます。- SETGIDまたはSETUIDバイナリが実行される場所に植え込まれたバイナリが安全でない状態で読み込まれるため、ローカルの権限昇格の脆弱性があります。ローカルの攻撃者が、悪意のあるバイナリーを通じて、ルート権限を取得するためにこれを悪用できます。（CVE-2016-5995）- SQLステートメントが不適切に処理されているため、サービス拒否の脆弱性がSQLNP_SCOPE_TRIAL()関数にあります。認証済みのリモートの攻撃者がこの脆弱性を悪用し、データベースをクラッシュさせる可能性があります。- 特定のクエリが不適切に処理されているため、Query Compiler QGMにサービス拒否の脆弱性があります。認証されているリモートの攻撃者がこの脆弱性を悪用し、特別に細工されたクエリを介してデータベースをクラッシュさせる可能性があります。

根據其版本，遠端主機上執行的 IBM DB2 10.5 安裝程式為 Fix Pack 8 之前版本。因此，會受到下列弱點影響：

  - 存在一個本機權限提升弱點，這是由於在將要執行 SETGID 或 SETUID 二進位檔的位置以不安全的方式載入其中植入的二進位檔所致。本機攻擊者可加以惡意利用，透過惡意的二進位檔取得 root 權限。(CVE-2016-5995)

  - SQLNP_SCOPE_TRIAL() 函式中存在一個拒絕服務弱點，這是因不當處理 SQL 陳述式所致。經驗證的遠端攻擊者可加以惡意利用造成資料庫損毀。

  - 查詢編譯器 QGM 存在一個拒絕服務弱點，這是因為不當處理特定查詢所致。經驗證的遠端攻擊者可加以惡意利用，透過特製的查詢來損毀資料庫。

根据其版本，远程主机上运行的 IBM DB2 10.5 安装版本低于 Fix Pack 8。因此，该数据库受到以下漏洞的影响：

  - 存在本地特权提升漏洞，这是在执行 SETGID 或 SETUID 二进制文件的位置以不安全的方式加载植入的二进制文件所致。本地攻击者可利用此漏洞，通过恶意二进制文件，获取根特权。(CVE-2016-5995)

  - SQLNP_SCOPE_TRIAL() 函数中存在拒绝服务漏洞，这是未正确处理 SQL 语句所致。经身份验证的远程攻击者可利用此漏洞致使数据库崩溃。

  - 由于未正确处理特殊查询，查询编译器 QGM 中存在拒绝服务漏洞。经身份验证的远程攻击者可利用此问题，通过特制的查询造成数据库崩溃。

Versions of IBM DB2 10.1 earlier than Fix Pack 5 are potentially affected by multiple vulnerabilities :

 - An unspecified flaw exists in the monitoring or audit facility due to passwords being stored when handling specially crafted commands.  A remote, authenticated attacker can exploit this to access sensitive information. (CVE-2014-0919)
 - A stack-based buffer overflow condition exists due to improper validation of user-supplied input when handling crafted 'ALTER MODULE' statements.  A remote, authenticated attacker can exploit this to cause a denial of service or execute arbitrary code. (CVE-2014-3094)
 - A flaw exists when handling a crafted 'UNION' clause in a subquery of a 'SELECT' statement.  A remote, authenticated attacker can exploit this to cause a denial of service. (CVE-2014-3095)
 - A denial of service vulnerability exists when immediate 'AUTO_REVAL' is enabled.  A remote, authenticated attacker can exploit this, via a crafted 'ALTER TABLE' statement, to crash the server. (CVE-2014-6159)
 - A denial of service vulnerability exists when handling an identity column within a crafted 'ALTER TABLE' statement.  A remote, authenticated attacker can exploit this vulnerability to crash the server. (CVE-2014-6209)
 - A denial of service vulnerability exists when handling multiple 'ALTER TABLE' statements specifying the same column.  A remote, authenticated attacker can exploit this vulnerability to crash the server. (CVE-2014-6210)
 - A flaw exists that is triggered when handling specially crafted XML queries.  A remote, authenticated attacker can exploit this to cause a consumption of resources, resulting in a denial of service. (CVE-2014-8901)
 - A flaw exists in the IBM Global Security Kit (GSKit) when handling RSA temporary keys in a non-export RSA key exchange ciphersuite.  A man-in-the-middle attacker can exploit this to downgrade the session security to use weaker EXPORT_RSA ciphers, thus allowing the attacker to more easily monitor or tamper with the encrypted stream. (CVE-2015-0138)
 - An unspecified flaw in the General Parallel File System (GPFS) allows a local attacker to gain root privileges. (CVE-2015-0197)
 - A flaw exists in the General Parallel File System (GPFS), related to certain cipherList configurations, that allows a remote attacker, using specially crafted data, to bypass authentication and execute arbitrary programs with root privileges. (CVE-2015-0198)
 - A denial of service vulnerability exists in the General Parallel File System (GPFS) that allows a local attacker to corrupt kernel memory by sending crafted ioctl character device calls to the mmfslinux kernel module. (CVE-2015-0199)
 - A security feature bypass vulnerability exists, known as Bar Mitzvah, due to improper combination of state data with key data by the RC4 cipher algorithm during the initialization phase.  A man-in-the-middle attacker can exploit this, via a brute-force attack using LSB values, to decrypt the traffic. (CVE-2015-2808)
 - An information disclosure vulnerability exists due to improper block cipher padding by TLSv1 when using Cipher Block Chaining (CBC) mode.  A remote attacker, via an 'Oracle Padding' side channel attack, can exploit this vulnerability to gain access to sensitive information.  Note that this is a variation of the 'POODLE' attack.
 - A double-free flaw exists in the CLI application.  The issue is triggered as user-supplied input is not properly validated when handling client disconnects.  This may allow a remote attacker to corrupt memory and cause a denial of service or potentially execute arbitrary code.
 - A flaw exists that is triggered when handling 'SUM' or 'GROUP' BY queries with a 'SUBSELECT' that contains unnest.  This may allow an attacker to cause the database to crash.
 - An unspecified flaw exists in the 'sqldRemoveCachedTableEntry()' function that may allow an authenticated attacker to cause a DB2 instance to crash.
 - A flaw exists that is triggered as user-supplied input is not properly validated when handling Partial Aggregation operators (PED, PEA).  This may allow an authenticated attacker to corrupt memory and cause a denial of service.
 - A flaw exists that is due to the program setting insecure 666 permissions for log files.  This may allow a local attacker to manipulate logs.
 - A flaw exists in the 'sqlex_find_group()' function in the handling of group names.  This issue is triggered when returning a cumulative group name length greater than 64k for a user id.  This may allow an authenticated attacker to crash the server.
 - A flaw exists in the 'sqlsBinSortPopulateRecPointers()' function.  The issue is triggered as user-supplied input is not properly validated when performing resettable sorts.  This may allow an authenticated attacker to corrupt memory and cause a denial of service.
 - A flaw exists that is triggered when handling generated tables with 'INSERT INTO' statements.  This may allow an authenticated attacker to cause DB2 to crash.
 - A flaw exists that is triggered when invoking runstats against a user temporary table while the index clause explicitly specifies index names while omitting the index scheme name.  This may allow an authenticated attacker to cause a crash.
 - A flaw exists in the DRDA communication protocol that is triggered during the handling of messages.  This may allow an authenticated remote attacker to trigger a large memory overwrite.
 - A flaw exists that is due to the program insecurely loading binaries planted in a location that a SETGID or SETUID binary would execute. This may allow a local attacker to gain elevated, root privileges.

Versions of IBM DB2 9.7 prior to Fix Pack 11 are potentially affected by multiple vulnerabilities :

 - A flaw exists in the query compiler QGM that is triggered when handling duplicate reloc entry queries. This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'SQLEX_FIND_GROUP()' function that is triggered during the handling of group name results. This may allow an authenticated attacker to crash the database.
 - A flaw exists in the Query Compiler QGM that is triggered during the handling of 'DBCLOB' column types. This may allow an authenticated attacker to crash the database.
 - A flaw exists in the 'SQLRA_GET_SECT_INFO_BY_CURSOR_NAME()' function in 'Relational Data Services' that is triggered during the handling of stored procedures. This may allow an authenticated attacker to crash the database.
 - A flaw exists that is due to the program insecurely loading binaries planted in a location that a SETGID or SETUID binary would execute. This may allow a local attacker to gain elevated, root privileges.

Versions of IBM DB2 10.5 prior to Fix Pack 8 and 11.x prior to 11.1 are potentially affected by multiple vulnerabilities :

 - An unspecified flaw exists that may allow a local attacker to gain elevated privileges. No further details have been provided by the vendor.
 - An unspecified flaw exists that may allow a local attacker to gain access to arbitrary memory locations. No further details have been provided by the vendor.
 - An unspecified flaw exists that is triggered when dereferencing user pointers. This may allow a local attacker to crash the file system.
 - A flaw exists in the 'DTDScanner::scanChildren()' function in 'validators/DTD/DTDScanner.cpp' that is triggered when handling user requests. With a specially crafted request, a context-dependent attacker can cause the application linked against the library to exhaust resources causing it to stop responding or crash.
 - A flaw exists that is triggered when a local attacker sets environment variables that are processed by setuid programs. This may allow the attacker to execute commands with root privileges.
 - A flaw exists that is triggered when a local attacker supplies command line parameters to setuid programs. This may allow the attacker to execute commands with root privileges.
 - An overflow condition exists that is triggered as certain input is not properly validated. This may allow an authenticated remote attacker to cause a buffer overflow, potentially allowing them to bypass security restrictions and disclose sensitive information.
 - A flaw exists that is due to the program insecurely loading binaries planted in a location that a SETGID or SETUID binary would execute. This may allow a local attacker to gain elevated, root privileges.
 - A flaw exists in the 'SQLNP_SCOPE_TRIAL()' function that is triggered during the handling of SQL statements. This may allow an authenticated attacker to crash the database.
 - Multiple flaws exist in the Query Compiler QGM that is triggered when handling specific queries. With a specially crafted query, an authenticated attacker can cause the database to crash.

ID	名前	製品	ファミリー	公開日	更新日	深刻度
94898	IBM DB2 10.5 < Fix Pack 8 Multiple Vulnerabilities	Nessus	Databases	2016/11/15	2024/10/23	high
94898	IBM DB2 10.5 < Fix Pack 8 複数の脆弱性	Nessus	Databases	2016/11/15	2024/10/23	high
94898	IBM DB2 10.5 < Fix Pack 8 多個弱點	Nessus	Databases	2016/11/15	2024/10/23	high
94898	IBM DB2 10.5 < Fix Pack 8 多个漏洞	Nessus	Databases	2016/11/15	2024/10/23	high
9197	IBM DB2 10.1 < Fix Pack 5 Multiple Vulnerabilities (Bar Mitzvah)	Nessus Network Monitor	Database	2016/4/15	2019/3/6	critical
9589	IBM DB2 9.7 < Fix Pack 11 Multiple Vulnerabilities	Nessus Network Monitor	Database	2016/9/30	2019/3/6	medium
9590	IBM DB2 10.5 < Fix Pack 8 / 11.x < 11.1 Multiple Vulnerabilities	Nessus Network Monitor	Database	2016/9/30	2019/3/6	critical

検出

プラグインの検索

high

high

high

high

critical

medium

critical