CVE-2019-4447

Name of the Vulnerable Software and Affected Versions IBM DB2 High Performance Unload load for LUW versions 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2

Description The issue concerns a setuid root binary db2hpum debug that trusts the PATH environment variable. A low-privileged user can execute arbitrary commands as root by altering the PATH variable to point to a user-controlled location. When a crash is induced, a trojan gdb command is executed.

Recommendations For IBM DB2 High Performance Unload load for LUW versions 6.1, 6.1.0.1, 6.1.0.1 IF1, 6.1.0.2, 6.1.0.2 IF1, and 6.1.0.1 IF2, consider restricting the PATH environment variable to prevent it from being altered by low-privileged users. As a temporary workaround, consider disabling the db2hpum debug binary until a patch is available.