PT-2012-3872

CVE-2012-2194

·

Published

2012-07-25

·

Updated

2017-12-22

Description by

CVSS 2.0
5.0
Medium
MetricsAV:N/AC:L/Au:N/C:N/I:P/A:N
Name of the Vulnerable Software and Affected Versions IBM DB2 versions 9.1 before FP12 IBM DB2 versions 9.5 through FP9 IBM DB2 versions 9.7 through FP6 IBM DB2 versions 9.8 through FP5 IBM DB2 versions 10.1
Description A directory traversal issue exists in the SQLJ.DB2 INSTALL JAR stored procedure, allowing remote attackers to replace JAR files.
Recommendations For IBM DB2 version 9.1, apply a fix to address the issue. For IBM DB2 version 9.5, update to at least FP10 to resolve the issue. For IBM DB2 version 9.7, update to at least FP7 to resolve the issue. For IBM DB2 version 9.8, update to at least FP6 to resolve the issue. For IBM DB2 version 10.1, update to a newer version to mitigate the risk.
Exploitability
Fix
Impacts
Vendors
Affected products
Weakness enumeration
CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\'Path Traversal\')
Related identifiers
CVE-2012-2194
Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com