CVE-2007-5757: Medium severity ibm db2 universal database vulnerability

Q: What is the severity of CVE-2007-5757?

CVE-2007-5757 has a critical severity rating as it allows local users to gain root privileges.

Q: How do I fix CVE-2007-5757?

To fix CVE-2007-5757, users should upgrade to IBM DB2 Universal Database version 8 FixPak 16 or version 9 Fix Pack 4 or later.

Q: Who is affected by CVE-2007-5757?

CVE-2007-5757 affects local users of IBM DB2 Universal Database versions prior to FixPak 16 for version 8 and prior to Fix Pack 4 for version 9.

Q: What type of vulnerability is CVE-2007-5757?

CVE-2007-5757 is identified as an untrusted search path vulnerability.

Q: Can CVE-2007-5757 be exploited remotely?

No, CVE-2007-5757 can only be exploited locally by authenticated users.

Published Feb 12, 2008

Updated

Untrusted search path vulnerability in db2pd in IBM DB2 Universal Database (UDB) 8 before FixPak 16 and 9 before Fix Pack 4 allows local users to gain root privileges via a modified DB2INSTANCE environment variable that points to a malicious library. NOTE: this might be the same issue as CVE-2008-0697.

Affected Software

2 affected components

IBM DB2 Universal Database=9.0-fixpak_3a

IBM DB2 Universal Database<=8.0

Remediation

Patch Available

http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=653

Event History

Feb 12, 2008

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2007-5757?

CVE-2007-5757 has a critical severity rating as it allows local users to gain root privileges.

How do I fix CVE-2007-5757?