CVE-2008-3857: Infoleak
Published Aug 28, 2008
·Updated
The Base Service Utilities component in IBM DB2 9.1 before Fixpak 5 retains a cleartext password in memory after the database connection that sent the password is fully established, which might allow local users to obtain sensitive information by reading a memory dump.
Affected Software
23 affected components
IBM DB2 Universal Database=9.1
IBM DB2 Universal Database=9.1
IBM DB2 Universal Database=9.1
IBM DB2 Universal Database=9.1
IBM DB2 Universal Database=9.1
IBM DB2 Universal Database=9.1-fp2
IBM DB2 Universal Database=9.1-fp2
IBM DB2 Universal Database=9.1-fp2
IBM DB2 Universal Database=9.1-fp2
IBM DB2 Universal Database=9.1-fp2
IBM DB2 Universal Database=9.1-fp3
IBM DB2 Universal Database=9.1-fp3
IBM DB2 Universal Database=9.1-fp3
IBM DB2 Universal Database=9.1-fp3
IBM DB2 Universal Database=9.1-fp3
IBM DB2 Universal Database=9.1-fp4
IBM DB2 Universal Database=9.1-fp4
IBM DB2 Universal Database=9.1-fp4
IBM DB2 Universal Database=9.1-fp4a
IBM DB2 Universal Database=9.1-fp4a
IBM DB2 Universal Database=9.1-fp4a
IBM DB2 Universal Database=9.1-fp4a
IBM DB2 Universal Database=9.1-fp4a
Remediation
Patch Available
Event History
Aug 28, 2008
CVE Published
via MITRE·05:00 PM
Data Sourced
via MITRE·05:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2008-3857?
CVE-2008-3857 has a medium severity rating as it allows local users to potentially access sensitive information.
2
What versions of IBM DB2 are affected by CVE-2008-3857?
CVE-2008-3857 affects IBM DB2 version 9.1 before Fixpak 5 across various platforms.
3
How do I fix CVE-2008-3857?
To mitigate CVE-2008-3857, upgrade IBM DB2 to version 9.1 Fixpak 5 or later.
4
What type of attack does CVE-2008-3857 enable?
CVE-2008-3857 enables local users to read memory dumps to obtain cleartext passwords.
5
Is it safe to use IBM DB2 version 9.1 before Fixpak 5?
Using IBM DB2 version 9.1 before Fixpak 5 is not safe due to the vulnerability identified in CVE-2008-3857.