CVE-2012-4826

Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IBM DB2 9.1, 9.5, 9.7 before FP7, 9.8, and 10.1 might allow remote authenticated users to execute arbitrary code by debugging a stored procedure.

CVSS v2.0 8.5 HIGH

8.5^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:M/Au:S/C:C/I:C/A:C

Exploitability : 6.8 / Impact : 10.0

Access Vector NETWORK

Access Complexity MEDIUM

Authentication SINGLE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://osvdb.org/86414
http://www-01.ibm.com/support/docview.wss?uid=swg1IC86765
http://www-01.ibm.com/support/docview.wss?uid=swg1IC86781	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg1IC86782
http://www-01.ibm.com/support/docview.wss?uid=swg1IC86783
http://www-01.ibm.com/support/docview.wss?uid=swg1IC87192
http://www-01.ibm.com/support/docview.wss?uid=swg21450666	Vendor Advisory
http://www-01.ibm.com/support/docview.wss?uid=swg21614536	Vendor Advisory
http://www.securityfocus.com/bid/56133

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:ibm:db2:9.1:::::::*
	cpe:2.3:a:ibm:db2:9.5:::::::*
	cpe:2.3:a:ibm:db2:9.7:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.1:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.2:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.3:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.4:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.5:::::::*
	cpe:2.3:a:ibm:db2:9.7.0.6:::::::*
	cpe:2.3:a:ibm:db2:9.8:::::::*
	cpe:2.3:a:ibm:db2:10.1:::::::*

History

No history.

Information

Published : 2012-10-20 10:41

Updated : 2024-02-04 18:16

NVD link : CVE-2012-4826

Mitre link : CVE-2012-4826

CVE.ORG link : CVE-2012-4826

JSON object : View

Products Affected

ibm

db2

CWE

CWE-119

Improper Restriction of Operations within the Bounds of a Memory Buffer

{"id": "CVE-2012-4826", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 8.5, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:S/C:C/I:C/A:C", "authentication": "SINGLE", "integrityImpact": "COMPLETE", "accessComplexity": "MEDIUM", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": false, "exploitabilityScore": 6.8, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-10-20T10:41:27.383", "references": [{"url": "http://osvdb.org/86414", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC86765", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC86781", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC86782", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC86783", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg1IC87192", "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21450666", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www-01.ibm.com/support/docview.wss?uid=swg21614536", "tags": ["Vendor Advisory"], "source": "psirt@us.ibm.com"}, {"url": "http://www.securityfocus.com/bid/56133", "source": "psirt@us.ibm.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-119"}]}], "descriptions": [{"lang": "en", "value": "Stack-based buffer overflow in the SQL/PSM (aka SQL Persistent Stored Module) Stored Procedure (SP) infrastructure in IBM DB2 9.1, 9.5, 9.7 before FP7, 9.8, and 10.1 might allow remote authenticated users to execute arbitrary code by debugging a stored procedure."}, {"lang": "es", "value": "Desbordamiento de b\u00fafer basado en pila en la infraestructura SQL/PSM (alias SQL Persistent Stored Module) Stored Procedure (SP) en IBM DB2 v9.1, v9.5, v9.7 antes de FP7, v9.8, y v10.1, podr\u00eda permitir a usuarios remotos autenticados ejecutar c\u00f3digo de su elecci\u00f3n depurando un procedimiento almacenado."}], "lastModified": "2013-03-02T04:46:14.640", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:ibm:db2:9.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "7B28091A-8772-41DC-9D91-D5359CDDA7A9"}, {"criteria": "cpe:2.3:a:ibm:db2:9.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11ABF7CC-2FA5-4F2D-901A-2D0EF5B8E717"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "CE1C4DE6-EB32-4A31-9FAA-D8DA31D8CF05"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A8A8E221-7045-4BAD-9B29-ABBC5216559D"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.2:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "56C39DC1-AD23-4F26-9727-EC0FBDF84BEE"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.3:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2513D42C-E558-4CC7-88D3-BB44F1B40157"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.4:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "6F441BE8-AEC0-44F0-875E-03C65A45CF68"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.5:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "036E9715-CFAA-4F2A-B432-181EDCA3D812"}, {"criteria": "cpe:2.3:a:ibm:db2:9.7.0.6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "9A55FBA0-4DFC-493D-91EF-EB56C241F9CE"}, {"criteria": "cpe:2.3:a:ibm:db2:9.8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D72D43DB-9A92-4E12-853B-F5FC9421D5EA"}, {"criteria": "cpe:2.3:a:ibm:db2:10.1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "2952EB24-A015-4EC7-85E3-88588D0AB15B"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@us.ibm.com"}